Finite - Pi-hole + Unbound flake for Raspberry Pi (feedback welcome)

1

Sharing a project I’ve been working on: finite, a NixOS flake for running Pi-hole + Unbound on Raspberry Pi.

Motivation:

Using NixOS on my desktop has been great, but it got me thinking - what if someone who’s never touched Linux wants network-wide ad blocking? My goal with finite is to make that possible: a setup simple enough that you can hand a
pre-flashed SD card to a friend and say “plug it in, it just works.”

Also hoping to bring more people from the Raspberry Pi community into NixOS. Pi projects are a natural gateway.

Repo: GitHub - wh1le/finite: Plug-and-play ad-blocking and DNS privacy for Raspberry Pi with Pi-hole + Unbound.

What it does:

Turns a Raspberry Pi into a network-wide ad blocker and private DNS server. Flash the SD card, boot, done.

Features

  • Pre-configured for Pi 3B+ and newer (aarch64)
  • Pi-hole in rootless podman container
  • Unbound as local recursive resolver (no Google/Cloudflare dependency)
  • Time sync pre-configured (prevents Unbound DNSSEC bootstrap errors)
  • SSH hardening out of the box
  • Config change? Build locally, deploy over SSH in ~10 mins

Would appreciate input from experienced Nix users on:

  1. Flake structure – is the module organization idiomatic?
  2. Settings pattern – using a settings.nix for user config, is there a better approach?
  3. Secrets management – I initially used SOPS but decided to ditch it because it’s too complicated for new users
  4. Security hardening – LUKS disabled and logging off by default (home LAN assumption, no internet exposure). Any low-hanging fruit I’m missing?

PRs welcome. Happy to answer questions.

2 Likes
2

I was reading along, liking what I saw until I saw this. Why not run it natively as a systemd service on the Pi? I’ve always preferred nix derivations over containers. I’m sure most would agree unless I’m missing something. Maybe I’m missing something about the pi-hole software that requires that it is run in a container. Certainly, running it as a native executable would be preferable (in my opinion) as mentioned here:

All else considered, I’ll definitely keep an eye on this project. Great work.

1 Like
3

harryprayiv Thanks! Yeah, when I started this there wasn’t a native module. Containers were basically the only way. Looks like 25.11 added pihole-ftl and pihole-web, I didn’t know that, so that’s cool! Might migrate to native into future. Thanks for the feedback!

1 Like
4

No problem! If you don’t add it, I’ll eventually fork and do it myself. Glad to see I wasn’t mistaken. Great job! Thanks for the prompt reply.

1 Like