brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: remove memory reservation and update docs for dockhand encryption key

Browse source
This commit is contained in:
Brian Pooe 2026-03-01 18:52:38 +02:00
parent 6edd9c91a9
commit 71de685b1b
4 changed files with 16 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.env.sample
View file

@ -84,7 +84,6 @@ TECHNITIUM_BLOCKLIST_URLS=https://raw.githubusercontent.com/StevenBlack/hosts/ma
TECHNITIUM_ALLOW_BLOCKING_REPORT=false
TECHNITIUM_PREFER_IPV6=false
TECHNITIUM_MEM_LIMIT=512m
TECHNITIUM_MEM_RESERVATION=192m
# Local persistent data path for Technitium on Pi (bind mount)
TECHNITIUM_CONFIG_DIR=./appdata/technitium
@ -93,7 +92,6 @@ DOCKHAND_ENCRYPTION_KEY=
DOCKHAND_PORT=3000
DOCKHAND_BIND_IP=0.0.0.0
DOCKHAND_MEM_LIMIT=256m
DOCKHAND_MEM_RESERVATION=64m
# Local persistent data path for Dockhand on Pi (bind mount)
DOCKHAND_DATA_DIR=./appdata/dockhand
# Host path containing compose stacks that Dockhand should manage

2
dns/end-to-end-migration-runbook.md
View file

@ -37,7 +37,7 @@ Expected:
1. Fill required values in `.env` (or environment file you use):
- `DNS_BIND_IP=192.168.60.6` (temporary during staging)
- `TECHNITIUM_ADMIN_PASSWORD=<strong-password>`
- `DOCKHAND_ENCRYPTION_KEY=<long-random-string>`
- `DOCKHAND_ENCRYPTION_KEY=<base64 key from openssl rand -base64 32>`
- `TECHNITIUM_CONFIG_DIR=./appdata/technitium`
- `DOCKHAND_DATA_DIR=./appdata/dockhand`
- `DOCKER_GID=<docker.sock group id>`

18
dns/technitium-dockhand-deployment.md
View file

@ -12,7 +12,7 @@ Compatibility note:
Update your `.env` with these required values:
- `DNS_BIND_IP=192.168.60.5`
- `TECHNITIUM_ADMIN_PASSWORD=<strong-password>`
- `DOCKHAND_ENCRYPTION_KEY=<long-random-string>`
- `DOCKHAND_ENCRYPTION_KEY=<base64 key that decodes to exactly 32 bytes>`
- `TECHNITIUM_CONFIG_DIR=./appdata/technitium`
- `DOCKHAND_DATA_DIR=./appdata/dockhand`
- `DOCKHAND_STACKS_DIR=./stacks` (or any local host path containing compose files)
@ -20,14 +20,18 @@ Update your `.env` with these required values:
For 2GB Pi 4 (recommended defaults already in `.env.sample`):
- `TECHNITIUM_MEM_LIMIT=512m`
- `TECHNITIUM_MEM_RESERVATION=192m`
- `DOCKHAND_MEM_LIMIT=256m`
- `DOCKHAND_MEM_RESERVATION=64m`
Tip:
- `DOCKER_GID` command: `stat -c '%g' /var/run/docker.sock`
- Relative bind paths (like `./appdata/...`) are resolved from the folder containing the rendered compose file (`docker-compose-files/`).
Generate a valid Dockhand encryption key:
```bash
openssl rand -base64 32
```
Paste the output into `.env` as `DOCKHAND_ENCRYPTION_KEY=...`.
Create local bind-mount folders:
```bash
mkdir -p docker-compose-files/appdata/technitium docker-compose-files/appdata/dockhand docker-compose-files/stacks
@ -78,3 +82,11 @@ nslookup switchlite8poe.home.brianpooe.com 192.168.60.5
## 7) Common gotchas
- If Technitium fails to bind port 53, check for other DNS services on the host (for example `systemd-resolved`, `dnsmasq`, old Pi-hole container).
- If Dockhand cannot manage containers, verify `DOCKER_GID` and docker socket mount.
- If Dockhand shows `Invalid ENCRYPTION_KEY`, regenerate with `openssl rand -base64 32`, re-render the compose file, and restart Dockhand.
- If `http://<DNS_BIND_IP>:5380` is refused, run:
```bash
docker compose -f docker-compose-files/technitium-dockhand.yaml ps technitium-dns
docker compose -f docker-compose-files/technitium-dockhand.yaml port technitium-dns 5380
ss -ltnp | grep 5380 || true
```
- Confirm `TECHNITIUM_WEB_BIND_IP` in `.env` is not `127.0.0.1`.

3
docker-compose-files/technitium-dockhand_template.yaml
View file

@ -1,4 +1,3 @@
version: '3.8'
services:
technitium-dns:
image: technitium/dns-server:latest
@ -41,7 +40,6 @@ services:
# - "{{DNS_BIND_IP:-0.0.0.0}}:853:853/tcp" # DoT
# - "{{DNS_BIND_IP:-0.0.0.0}}:443:443/tcp" # DoH
mem_limit: "{{TECHNITIUM_MEM_LIMIT:-512m}}"
mem_reservation: "{{TECHNITIUM_MEM_RESERVATION:-192m}}"
security_opt:
- no-new-privileges:true
logging:
@ -76,7 +74,6 @@ services:
ports:
- "{{DOCKHAND_BIND_IP:-0.0.0.0}}:{{DOCKHAND_PORT:-3000}}:3000/tcp"
mem_limit: "{{DOCKHAND_MEM_LIMIT:-256m}}"
mem_reservation: "{{DOCKHAND_MEM_RESERVATION:-64m}}"
security_opt:
- no-new-privileges:true
logging: