[Sportarr]

What it does

Pi-hole blocks ads and trackers for the whole network by answering its DNS. This script wraps the TrueNAS stable app pihole.

How it installs

The script asks one question, the admin password, with a random default and the generate button. Its description also tells the user to point the router's DNS at the server.

Port 53 needed a different setup on HexOS:

• Publishing 0.0.0.0:53 fails. The TrueNAS virtualization service holds 10.48.24.1:53 on incusbr0, so the render's conflict check refuses the install. Your remote access also holds port 53 on hexos0.
• app.ip_choices offers only 0.0.0.0 and ::, so host_ips cannot pick the LAN address.
• So the app uses the host network, and FTLCONF_misc_dnsmasq_lines adds bind-dynamic, except-interface=incusbr0 and except-interface=hexos0. Pi-hole then binds every interface address except those two.

Other choices:

• Config and dnsmasq stay TrueNAS ixVolumes. On a HexOS folder, the first start wrote adlists.list as root before Pi-hole took ownership of the folder, and the folder's ACL has no everyone entry. Pi-hole's gravity run then could not read it and built an empty blocklist.
• FTLCONF_ntp_ipv4_active, FTLCONF_ntp_ipv6_active and FTLCONF_ntp_sync_active are off. TrueNAS already runs NTP on port 123, and on the host network Pi-hole could otherwise set the server's clock.
• The web port is 20720, the TrueNAS default, and the portal opens /admin/.

Testing

• bun _lib/validate.ts passes with 0 errors and 0 warnings.
• I installed it on my HexOS server (TrueNAS 25.10, HexOS 2026.10.16). The default blocklist loaded 71,493 domains and doubleclick.net resolved to 0.0.0.0. Normal names resolved through 192.168.1.65:53, and the Incus and remote access DNS listeners kept answering on their own addresses. The admin password signed in through the API and a wrong one was refused. The host clock stayed synchronized.

Known limits

• I could only check the interface names on my own server. Do all HexOS servers use incusbr0 and hexos0? If not, the dnsmasq lines need another approach.
• Pi-hole can't start alongside another DNS server on the same address, such as AdGuard Home.