Explicitly log migration process

Signed-off-by: DL6ER <dl6er@dl6er.de>

.codespellignore

@@ -0,0 +1,4 @@
+doubleclick
+wan
+nwe
+padd

.editorconfig

@@ -0,0 +1,20 @@
+# EditorConfig is awesome: https://editorconfig.org/
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = tab
+tab_width = 4
+charset = utf-8
+trim_trailing_whitespace = true
+
+[*.yml]
+tab_width = 2
+
+[*.md]
+tab_width = 2

.gitattributes

@@ -0,0 +1,38 @@
+# FROM https://github.com/libgit2/libgit2sharp
+# Text files that should be normalized to LF in odb.
+*.cs     text diff=csharp
+*.config text
+
+*.sln     text
+*.csproj  text
+
+*.md       text
+*.sh       text
+*.ps1      text
+*.cmd      text
+*.bat      text
+*.markdown text
+*.msbuild  text
+
+Lib/*  binary
+GitHub.Tests.Integration/Resources/*  binary
+
+
+# Binary files that should not be normalized or diffed
+*.png    binary
+*.jpg    binary
+*.gif    binary
+
+*.pfx    binary
+*.snk    binary
+*.dll    binary
+*.exe    binary
+*.lib    binary
+*.exp    binary
+*.pdb    binary
+*.sdf    binary
+*.7z     binary
+
+
+# Catch all for anything we forgot. Add rules if you get CRLF -> LF warnings.
+* text eol=lf

.github/dco.yml

@@ -0,0 +1,2 @@
+require:
+  members: false

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "10:00"
+  open-pull-requests-limit: 10
+  target-branch: development
+  reviewers:
+    - "pi-hole/core-maintainers"
+- package-ecosystem: pip
+  directory: "/test"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "10:00"
+  open-pull-requests-limit: 10
+  target-branch: development
+  reviewers:
+    - "pi-hole/core-maintainers"

.github/release.yml

@@ -0,0 +1,7 @@
+changelog:
+  exclude:
+    labels:
+      - internal
+    authors:
+      - dependabot
+      - github-actions

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,40 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - master
+      - development
+  pull_request:
+    branches:
+      - master
+      - development
+  schedule:
+    - cron: '32 11 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+    -
+      name: Checkout repository
+      uses: actions/checkout@v4.2.2
+    # Initializes the CodeQL tools for scanning.
+    -
+      name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: 'python'
+    -
+      name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+    -
+      name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3

.github/workflows/merge-conflict.yml

@@ -0,0 +1,21 @@
+name: "Check for merge conflicts"
+on:
+  # So that PRs touching the same files as the push are updated
+  push:
+  # So that the `dirtyLabel` is removed if conflicts are resolve
+  # We recommend `pull_request_target` so that github secrets are available.
+  # In `pull_request` we wouldn't be able to change labels of fork PRs
+  pull_request_target:
+    types: [synchronize]
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if PRs are have merge conflicts
+        uses: eps1lon/actions-label-merge-conflict@v3.0.2
+        with:
+          dirtyLabel: "PR: Merge Conflict"
+          repoToken: "${{ secrets.GITHUB_TOKEN }}"
+          commentOnDirty: "This pull request has conflicts, please resolve those before we can evaluate the pull request."
+          commentOnClean: "Conflicts have been resolved."

.github/workflows/stale.yml

@@ -0,0 +1,47 @@
+name: Mark stale issues
+
+on:
+  schedule:
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+  issue_comment:
+
+env:
+  stale_label: stale
+
+jobs:
+  stale_action:
+    if: github.event_name != 'issue_comment'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - uses: actions/stale@v9.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-stale: 30
+          days-before-close: 5
+          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.'
+          stale-issue-label: '${{ env.stale_label }}'
+          exempt-issue-labels: 'Internal, Fixed in next release, Bug: Confirmed, Documentation Needed'
+          exempt-all-issue-assignees: true
+          operations-per-run: 300
+          close-issue-reason: 'not_planned'
+
+  remove_stale:
+    # trigger "stale" removal immediately when stale issues are commented on
+    # we need to explicitly check that the trigger does not run on comment on a PR as
+    # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issue_comment-on-issues-only-or-pull-requests-only
+    if: ${{ !github.event.issue.pull_request && github.event_name != 'schedule' }}
+    permissions:
+      contents: read #  for actions/checkout
+      issues: write #  to edit issues label
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.2
+      - name: Remove 'stale' label
+        run: gh issue edit ${{ github.event.issue.number }} --remove-label ${{ env.stale_label }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale_pr.yml

@@ -0,0 +1,35 @@
+name: Close stale PR
+# This action will add a `stale` label and close immediately every PR that meets the following conditions:
+#   - it is already marked with "merge conflict" label
+#   - there was no update/comment on the PR in the last 30 days.
+
+on:
+  schedule:
+    - cron: '0 10 * * *'
+  workflow_dispatch:
+
+jobs:
+  stale:
+
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/stale@v9.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          # Do not automatically mark PR/issue as stale
+          days-before-stale: -1
+          # Override 'days-before-stale' for PR only
+          days-before-pr-stale: 30
+          # Close PRs immediately, after marking them 'stale'
+          days-before-pr-close: 0
+          # only run the action on merge conflict PR
+          any-of-labels: 'PR: Merge Conflict'
+          exempt-pr-labels: 'internal, never-stale, ON HOLD, WIP'
+          exempt-all-pr-assignees: true
+          operations-per-run: 300
+          stale-pr-message: ''
+          close-pr-message: 'Existing merge conflicts have not been addressed. This PR is considered abandoned.'

.github/workflows/sync-back-to-dev.yml

@@ -0,0 +1,40 @@
+name: Sync Back to Development
+
+on:
+  push:
+    branches:
+      - master
+
+# The section is needed to drop the default write-all permissions for all jobs
+# that are granted on `push` event. By specifying any permission explicitly
+# all others are set to none. By using the principle of least privilege the damage a compromised
+# workflow can do (because of an injection or compromised third party tool or
+# action) is restricted. Adding labels to issues, commenting
+# on pull-requests, etc. may need additional permissions:
+#
+# Syntax for this section:
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+#
+# Reference for how to assign permissions on a job-by-job basis:
+# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+#
+# Reference for available permissions that we can enable if needed:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+permissions: {}
+
+jobs:
+  sync-branches:
+    # The job needs to be able to pull the code and create a pull request.
+    permissions:
+      contents: read #  for actions/checkout
+      pull-requests: write #  to create pull request
+
+    runs-on: ubuntu-latest
+    name: Syncing branches
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.2
+      - name: Opening pull request
+        run: gh pr create -B development -H master --title 'Sync master back into development' --body 'Created by Github action' --label 'internal'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,91 @@
+name: Test Supported Distributions
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+env:
+  FORCE_COLOR: 1
+  PYTHONUNBUFFERED: 1
+  PYTHONUTF8: 1
+
+jobs:
+  smoke-tests:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4.2.2
+
+      - name: Check scripts in repository are executable
+        run: |
+          IFS=$'\n';
+          for f in $(find . -name '*.sh'); do if [[ ! -x $f ]]; then echo "$f is not executable" && FAIL=1; fi ;done
+          unset IFS;
+          # If FAIL is 1 then we fail.
+          [[ $FAIL == 1 ]] && exit 1 || echo "Scripts are executable!"
+
+      - name: Run shellcheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          check_together: 'yes'
+          format: tty
+          severity: error
+
+      - name: Spell-Checking
+        uses: codespell-project/actions-codespell@master
+        with:
+          ignore_words_file: .codespellignore
+
+      - name: Get editorconfig-checker
+        uses: editorconfig-checker/action-editorconfig-checker@main # tag v1.0.0 is really out of date
+
+      - name: Run editorconfig-checker
+        run: editorconfig-checker
+
+      - name: Check python code formatting with black
+        uses: psf/black@stable
+        with:
+          src: "./test"
+          options: "--check --diff --color"
+
+  distro-test:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    needs: smoke-tests
+    strategy:
+      fail-fast: false
+      matrix:
+        distro:
+          [
+            debian_11,
+            debian_12,
+            ubuntu_20,
+            ubuntu_22,
+            ubuntu_24,
+            centos_9,
+            fedora_40,
+            fedora_41,
+          ]
+    env:
+      DISTRO: ${{matrix.distro}}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4.2.2
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5.3.0
+        with:
+          python-version: "3.10"
+
+      - name: Install wheel
+        run:  pip install wheel
+
+      - name: Install dependencies
+        run: pip install -r test/requirements.txt
+
+      - name: Test with tox
+        run: tox -c test/tox.${DISTRO}.ini

.gitignore

@@ -0,0 +1,12 @@
+.DS_Store
+*.pyc
+*.swp
+__pycache__
+.cache
+.pytest_cache
+.tox
+.eggs
+*.egg-info
+.idea/
+*.iml
+.vscode/

CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributors Guide
+
+Please read and understand the contribution guide before creating an issue or pull request.
+
+The guide can be found here: [https://docs.pi-hole.net/guides/github/contributing/](https://docs.pi-hole.net/guides/github/contributing/)

LICENSE

@@ -1,339 +1,146 @@
-GNU GENERAL PUBLIC LICENSE
+Copyright (C) 2017 Pi-hole, LLC (https://pi-hole.net)
-                       Version 2, June 1991
+Pi-hole Core
 
- Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
+This software is licensed under the European Union Public License (EUPL)
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+The license is available in the 22 official languages of the EU. The English version is included here.
- Everyone is permitted to copy and distribute verbatim copies
+Please see https://joinup.ec.europa.eu/community/eupl/og_page/eupl for official translations of the other languages.
- of this license document, but changing it is not allowed.
 
-                            Preamble
+This license applies to the whole project EXCEPT:
 
-  The licenses for most software are designed to take away your
+ - any commits made to the master branch prior to the release of version 3.0
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
 
-  When we speak of free software, we are referring to freedom, not
+The licenses that existed prior to this change have remained intact.
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
 
-  To protect your rights, we need to make restrictions that forbid
+-------------------------------------------------------------
-anyone to deny you these rights or to ask you to surrender the rights.
+EUROPEAN UNION PUBLIC LICENCE v. 1.2
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
 
-  For example, if you distribute copies of such a program, whether
+EUPL © the European Union 2007, 2016
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
 
-  We protect your rights with two steps: (1) copyright the software, and
+This European Union Public Licence (the EUPL) applies to the Work (as defined below) which is provided under the terms of this Licence. Any use of the Work, other than as authorised under this Licence is prohibited (to the extent such use is covered by a right of the copyright holder of the Work).
-(2) offer you this license which gives you legal permission to copy,
+The Work is provided under the terms of this Licence when the Licensor (as defined below) has placed the following notice immediately following the copyright notice for the Work:
-distribute and/or modify the software.
+Licensed under the EUPL
+or has expressed by any other means his willingness to license under the EUPL.
 
-  Also, for each author's protection and ours, we want to make certain
+1. Definitions
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
 
-  Finally, any free program is threatened constantly by software
+In this Licence, the following terms have the following meaning:
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
 
-  The precise terms and conditions for copying, distribution and
+- The Licence: this Licence.
-modification follow.
+- The Original Work: the work or software distributed or communicated by the Licensor under this Licence, available as Source Code and also as Executable Code as the case may be.
+- Derivative Works: the works or software that could be created by the Licensee, based upon the Original Work or modifications thereof. This Licence does not define the extent of modification or dependence on the Original Work required in order to classify a work as a Derivative Work; this extent is determined by copyright law applicable in the country mentioned in Article 15.
+- The Work: the Original Work or its Derivative Works.
+- The Source Code: the human-readable form of the Work which is the most convenient for people to study and modify.
+- The Executable Code: any code which has generally been compiled and which is meant to be interpreted by a computer as a program.
+- The Licensor: the natural or legal person that distributes or communicates the Work under the Licence.
+- Contributor(s): any natural or legal person who modifies the Work under the Licence, or otherwise contributes to the creation of a Derivative Work.
+- The Licensee or You: any natural or legal person who makes any usage of the Work under the terms of the Licence.
+- Distribution or Communication: any act of selling, giving, lending, renting, distributing, communicating, transmitting, or otherwise making available, online or offline, copies of the Work or providing access to its essential functionalities at the disposal of any other natural or legal person.
 
-                    GNU GENERAL PUBLIC LICENSE
+2. Scope of the rights granted by the Licence
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
-  0. This License applies to any program or other work which contains
+The Licensor hereby grants You a worldwide, royalty-free, non-exclusive, sublicensable licence to do the following, for the duration of copyright vested in the Original Work:
-a notice placed by the copyright holder saying it may be distributed
+- use the Work in any circumstance and for all usage,
-under the terms of this General Public License.  The "Program", below,
+- reproduce the Work,
-refers to any such program or work, and a "work based on the Program"
+- modify the Work, and make Derivative Works based upon the Work,
-means either the Program or any derivative work under copyright law:
+- communicate to the public, including the right to make available or display the Work or copies thereof to the public and perform publicly, as the case may be, the Work,
-that is to say, a work containing the Program or a portion of it,
+- distribute the Work or copies thereof,
-either verbatim or with modifications and/or translated into another
+- lend and rent the Work or copies thereof,
-language.  (Hereinafter, translation is included without limitation in
+- sublicense rights in the Work or copies thereof.
-the term "modification".)  Each licensee is addressed as "you".
+Those rights can be exercised on any media, supports and formats, whether now known or later invented, as far as the applicable law permits so.
+In the countries where moral rights apply, the Licensor waives his right to exercise his moral right to the extent allowed by law in order to make effective the licence of the economic rights here above listed.
+The Licensor grants to the Licensee royalty-free, non-exclusive usage rights to any patents held by the Licensor, to the extent necessary to make use of the rights granted on the Work under this Licence.
 
-Activities other than copying, distribution and modification are not
+3. Communication of the Source Code
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
 
-  1. You may copy and distribute verbatim copies of the Program's
+The Licensor may provide the Work either in its Source Code form, or as Executable Code. If the Work is provided as Executable Code, the Licensor provides in addition a machine-readable copy of the Source Code of the Work along with each copy of the Work that the Licensor distributes or indicates, in a notice following the copyright notice attached to the Work, a repository where the Source Code is easily and freely accessible for as long as the Licensor continues to distribute or communicate the Work.
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
 
-You may charge a fee for the physical act of transferring a copy, and
+4. Limitations on copyright
-you may at your option offer warranty protection in exchange for a fee.
 
-  2. You may modify your copy or copies of the Program or any portion
+Nothing in this Licence is intended to deprive the Licensee of the benefits from any exception or limitation to the exclusive rights of the rights owners in the Work, of the exhaustion of those rights or of other applicable limitations thereto.
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
 
-    a) You must cause the modified files to carry prominent notices
+5. Obligations of the Licensee
-    stating that you changed the files and the date of any change.
 
-    b) You must cause any work that you distribute or publish, that in
+The grant of the rights mentioned above is subject to some restrictions and obligations imposed on the Licensee. Those obligations are the following:
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
 
-    c) If the modified program normally reads commands interactively
+Attribution right: The Licensee shall keep intact all copyright, patent or trademarks notices and all notices that refer to the Licence and to the disclaimer of warranties. The Licensee must include a copy of such notices and a copy of the Licence with every copy of the Work he/she distributes or communicates. The Licensee must cause any Derivative Work to carry prominent notices stating that the Work has been modified and the date of modification.
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
 
-These requirements apply to the modified work as a whole.  If
+Copyleft clause: If the Licensee distributes or communicates copies of the Original Works or Derivative Works, this Distribution or Communication will be done under the terms of this Licence or of a later version of this Licence unless the Original Work is expressly distributed only under this version of the Licence - for example by communicating EUPL v. 1.2 only. The Licensee (becoming Licensor) cannot offer or impose any additional terms or conditions on the Work or Derivative Work that alter or restrict the terms of the Licence.
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
 
-Thus, it is not the intent of this section to claim rights or contest
+Compatibility clause: If the Licensee Distributes or Communicates Derivative Works or copies thereof based upon both the Work and another work licensed under a Compatible Licence, this Distribution or Communication can be done under the terms of this Compatible Licence. For the sake of this clause, Compatible Licence refers to the licences listed in the appendix attached to this Licence. Should the Licensee's obligations under the Compatible Licence conflict with his/her obligations under this Licence, the obligations of the Compatible Licence shall prevail.
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
 
-In addition, mere aggregation of another work not based on the Program
+Provision of Source Code: When distributing or communicating copies of the Work, the Licensee will provide a machine-readable copy of the Source Code or indicate a repository where this Source will be easily and freely available for as long as the Licensee continues to distribute or communicate the Work.
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
 
-  3. You may copy and distribute the Program (or a work based on it,
+Legal Protection: This Licence does not grant permission to use the trade names, trademarks, service marks, or names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the copyright notice.
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
 
-    a) Accompany it with the complete corresponding machine-readable
+6. Chain of Authorship
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
 
-    b) Accompany it with a written offer, valid for at least three
+The original Licensor warrants that the copyright in the Original Work granted hereunder is owned by him/her or licensed to him/her and that he/she has the power and authority to grant the Licence.
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
 
-    c) Accompany it with the information you received as to the offer
+Each Contributor warrants that the copyright in the modifications he/she brings to the Work are owned by him/her or licensed to him/her and that he/she has the power and authority to grant the Licence.
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
 
-The source code for a work means the preferred form of the work for
+Each time You accept the Licence, the original Licensor and subsequent Contributors grant You a licence to their contributions to the Work, under the terms of this Licence.
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
 
-If distribution of executable or object code is made by offering
+7. Disclaimer of Warranty
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
 
-  4. You may not copy, modify, sublicense, or distribute the Program
+The Work is a work in progress, which is continuously improved by numerous Contributors. It is not a finished work and may therefore contain defects or bugs inherent to this type of development.
-except as expressly provided under this License.  Any attempt
+For the above reason, the Work is provided under the Licence on an as is basis and without warranties of any kind concerning the Work, including without limitation merchantability, fitness for a particular purpose, absence of defects or errors, accuracy, non-infringement of intellectual property rights other than copyright as stated in Article 6 of this Licence.
-otherwise to copy, modify, sublicense or distribute the Program is
+This disclaimer of warranty is an essential part of the Licence and a condition for the grant of any rights to the Work.
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
 
-  5. You are not required to accept this License, since you have not
+8. Disclaimer of Liability
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
 
-  6. Each time you redistribute the Program (or any work based on the
+Except in the cases of wilful misconduct or damages directly caused to natural persons, the Licensor will in no event be liable for any direct or indirect, material or moral, damages of any kind, arising out of the Licence or of the use of the Work, including without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, loss of data or any commercial damage, even if the Licensor has been advised of the possibility of such damage. However, the Licensor will be liable under statutory product liability laws as far such laws apply to the Work.
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
 
-  7. If, as a consequence of a court judgment or allegation of patent
+9. Additional agreements
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
 
-If any portion of this section is held invalid or unenforceable under
+While distributing the Work, You may choose to conclude an additional agreement, defining obligations or services consistent with this Licence. However, if accepting obligations, You may act only on your own behalf and on your sole responsibility, not on behalf of the original Licensor or any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against such Contributor by the fact You have accepted any warranty or additional liability.
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
 
-It is not the purpose of this section to induce you to infringe any
+10. Acceptance of the Licence
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
 
-This section is intended to make thoroughly clear what is believed to
+The provisions of this Licence can be accepted by clicking on an icon I agree placed under the bottom of a window displaying the text of this Licence or by affirming consent in any other similar way, in accordance with the rules of applicable law. Clicking on that icon indicates your clear and irrevocable acceptance of this Licence and all of its terms and conditions.
-be a consequence of the rest of this License.
+Similarly, you irrevocably accept this Licence and all of its terms and conditions by exercising any rights granted to You by Article 2 of this Licence, such as the use of the Work, the creation by You of a Derivative Work or the Distribution or Communication by You of the Work or copies thereof.
 
-  8. If the distribution and/or use of the Program is restricted in
+11. Information to the public
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
 
-  9. The Free Software Foundation may publish revised and/or new versions
+In case of any Distribution or Communication of the Work by means of electronic communication by You (for example, by offering to download the Work from a remote location) the distribution channel or media (for example, a website) must at least provide to the public the information requested by the applicable law regarding the Licensor, the Licence and the way it may be accessible, concluded, stored and reproduced by the Licensee.
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
 
-Each version is given a distinguishing version number.  If the Program
+12. Termination of the Licence
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
 
-  10. If you wish to incorporate parts of the Program into other free
+The Licence and the rights granted hereunder will terminate automatically upon any breach by the Licensee of the terms of the Licence.
-programs whose distribution conditions are different, write to the author
+Such a termination will not terminate the licences of any person who has received the Work from the Licensee under the Licence, provided such persons remain in full compliance with the Licence.
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
 
-                            NO WARRANTY
+13. Miscellaneous
 
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+Without prejudice of Article 9 above, the Licence represents the complete agreement between the Parties as to the Work.
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+If any provision of the Licence is invalid or unenforceable under applicable law, this will not affect the validity or enforceability of the Licence as a whole. Such provision will be construed or reformed so as necessary to make it valid and enforceable.
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+The European Commission may publish other linguistic versions or new versions of this Licence or updated versions of the Appendix, so far this is required and reasonable, without reducing the scope of the rights granted by the Licence. New versions of the Licence will be published with a unique version number.
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+All linguistic versions of this Licence, approved by the European Commission, have identical value. Parties can take advantage of the linguistic version of their choice.
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
 
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+14. Jurisdiction
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
 
-                     END OF TERMS AND CONDITIONS
+Without prejudice to specific agreement between parties,
+- any litigation resulting from the interpretation of this License, arising between the European Union institutions, bodies, offices or agencies, as a Licensor, and any Licensee, will be subject to the jurisdiction of the Court of Justice of the European Union, as laid down in article 272 of the Treaty on the Functioning of the European Union,
+- any litigation arising between other parties and resulting from the interpretation of this License, will be subject to the exclusive jurisdiction of the competent court where the Licensor resides or conducts its primary business.
 
-            How to Apply These Terms to Your New Programs
+15. Applicable Law
 
-  If you develop a new program, and you want it to be of the greatest
+Without prejudice to specific agreement between parties,
-possible use to the public, the best way to achieve this is to make it
+- this Licence shall be governed by the law of the European Union Member State where the Licensor has his seat, resides or has his registered office,
-free software which everyone can redistribute and change under these terms.
+- this licence shall be governed by Belgian law if the Licensor has no seat, residence or registered office inside a European Union Member State.
 
-  To do so, attach the following notices to the program.  It is safest
+===
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
 
-    {description}
+Appendix
-    Copyright (C) {year}  {fullname}
 
-    This program is free software; you can redistribute it and/or modify
+Compatible Licences according to Article 5 EUPL are:
-    it under the terms of the GNU General Public License as published by
+- GNU General Public License (GPL) v. 2, v. 3
-    the Free Software Foundation; either version 2 of the License, or
+- GNU Affero General Public License (AGPL) v. 3
-    (at your option) any later version.
+- Open Software License (OSL) v. 2.1, v. 3.0
-
+- Eclipse Public License (EPL) v. 1.0
-    This program is distributed in the hope that it will be useful,
+- CeCILL v. 2.0, v. 2.1
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
+- Mozilla Public Licence (MPL) v. 2
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+- GNU Lesser General Public Licence (LGPL) v. 2.1, v. 3
-    GNU General Public License for more details.
+- Creative Commons Attribution-ShareAlike v. 3.0 Unported (CC BY-SA 3.0) for works other than software
-
+- European Union Public Licence (EUPL) v. 1.1, v. 1.2
-    You should have received a copy of the GNU General Public License along
+- Québec Free and Open-Source Licence - Reciprocity (LiLiQ-R) or Strong Reciprocity (LiLiQ-R+)
-    with this program; if not, write to the Free Software Foundation, Inc.,
+- The European Commission may update this Appendix to later versions of the above licences without producing a new version of the EUPL, as long as they provide the rights granted in Article 2 of this Licence and protect the covered Source Code from exclusive appropriation.
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+-  All other changes or additions to this Appendix require the production of a new EUPL version.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  {signature of Ty Coon}, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.

README.md

@@ -1,85 +1,171 @@
-# Automated Install 
+<!-- markdownlint-configure-file { "MD004": { "style": "consistent" } } -->
-##### Designed For Raspberry Pi B, B+, 2, and Zero (with an Ethernet adapter)
+<!-- markdownlint-disable MD033 -->
+#
 
-1. Install Raspbian 
+<p align="center">
-2. Run the command below
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://pi-hole.github.io/graphics/Vortex/Vortex_Vertical_wordmark_darkmode.png">
+    <source media="(prefers-color-scheme: light)" srcset="https://pi-hole.github.io/graphics/Vortex/Vortex_Vertical_wordmark_lightmode.png">
+    <img src="https://pi-hole.github.io/graphics/Vortex/Vortex_Vertical_wordmark_lightmode.png" width="168" height="270" alt="Pi-hole website">
+  </picture>
+    <br>
+    <strong>Network-wide ad blocking via your own Linux hardware</strong>
+</p>
 
-### ```curl -L install.pi-hole.net | bash```
+<!-- markdownlint-enable MD033 -->
 
-Once installed, [configure your router to have **DHCP clients use the Pi as their DNS server**](http://pi-hole.net/faq/can-i-set-the-pi-hole-to-be-the-dns-server-at-my-router-so-i-dont-have-to-change-settings-for-my-devices/) and then any device that connects to your network will have ads blocked without any further configuration.  Alternatively, you can manually set each device to [use the Raspberry Pi as its DNS server](http://pi-hole.net/faq/how-do-i-use-the-pi-hole-as-my-dns-server/).
+The Pi-hole® is a [DNS sinkhole](https://en.wikipedia.org/wiki/DNS_Sinkhole) that protects your devices from unwanted content without installing any client-side software.
 
-## Pi-hole Is Free, But Powered By Your Donations
+- **Easy-to-install**: our dialogs walk you through the simple installation process in less than ten minutes
-[![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donateCC_LG.gif "Free, but powered by donations")](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=3J2L3Z4DHW9UY "Donate")
+- **Resolute**: content is blocked in _non-browser locations_, such as ad-laden mobile apps and smart TVs
+- **Responsive**: seamlessly speeds up the feel of everyday browsing by caching DNS queries
+- **Lightweight**: runs smoothly with [minimal hardware and software requirements](https://docs.pi-hole.net/main/prerequisites/)
+- **Robust**: a command-line interface that is quality assured for interoperability
+- **Insightful**: a beautiful responsive Web Interface dashboard to view and control your Pi-hole
+- **Versatile**: can optionally function as a [DHCP server](https://discourse.pi-hole.net/t/how-do-i-use-pi-holes-built-in-dhcp-server-and-why-would-i-want-to/3026), ensuring _all_ your devices are protected automatically
+- **Scalable**: [capable of handling hundreds of millions of queries](https://pi-hole.net/2017/05/24/how-much-traffic-can-pi-hole-handle/) when installed on server-grade hardware
+- **Modern**: blocks ads over both IPv4 and IPv6
+- **Free**: open source software that helps ensure _you_ are the sole person in control of your privacy
 
-## How Does It Work?
+-----
-**Watch the 60-second video below to get a quick overview**
 
-[![Pi-hole exlplained](http://i.imgur.com/qNybJDX.png)](https://vimeo.com/135965232)
+## One-Step Automated Install
 
-## Pi-hole Projects
+Those who want to get started quickly and conveniently may install Pi-hole using the following command:
-- [Pi-hole Chrome extension](https://chrome.google.com/webstore/detail/pi-hole-list-editor/hlnoeoejkllgkjbnnnhfolapllcnaglh) ([open source](https://github.com/packtloss/pihole-extension))
-- [Go Bananas for CHiP-hole ad blocking](https://www.hackster.io/jacobsalmela/chip-hole-network-wide-ad-blocker-98e037)
-- [Sky-Hole](http://dlaa.me/blog/post/skyhole)
-- [Pi-hole in the Cloud!](http://blog.codybunch.com/2015/07/28/Pi-Hole-in-the-cloud/)
-- [unRaid-hole](https://github.com/spants/unraidtemplates/blob/master/Spants/unRaid-hole.xml#L13)--[Repo and more info](http://lime-technology.com/forum/index.php?PHPSESSID=c0eae3e5ef7e521f7866034a3336489d&topic=38486.0)
-- [Pi-hole on/off button](http://thetimmy.silvernight.org/pages/endisbutton/)
-- [Minibian Pi-hole](http://munkjensen.net/wiki/index.php/See_my_Pi-Hole#Minibian_Pi-hole)
 
-## Coverage
+```bash
-- [MacObserver Podcast 585](http://www.macobserver.com/tmo/podcast/macgeekgab-585)
+curl -sSL https://install.pi-hole.net | bash
-- [Medium: Block All Ads For $53](https://medium.com/@robleathern/block-ads-on-all-home-devices-for-53-18-a5f1ec139693#.gj1xpgr5d)
-- [MakeUseOf: Adblock Everywhere, The Pi-hole Way](http://www.makeuseof.com/tag/adblock-everywhere-raspberry-pi-hole-way/)
-- [Lifehacker: Turn Your Pi Into An Ad Blocker With A Single Command](http://lifehacker.com/turn-a-raspberry-pi-into-an-ad-blocker-with-a-single-co-1686093533)!
-- [Pi-hole on TekThing](https://youtu.be/8Co59HU2gY0?t=2m)
-- [Pi-hole on Security Now! Podcast](http://www.youtube.com/watch?v=p7-osq_y8i8&t=100m26s)
-- [Foolish Tech Show](https://youtu.be/bYyena0I9yc?t=2m4s)
-- [Pi-hole on Ubuntu](http://www.boyter.org/2015/12/pi-hole-ubuntu-14-04/)
-- [Catchpoint: iOS 9 Ad Blocking](http://blog.catchpoint.com/2015/09/14/ad-blocking-apple/)
-
-## Partnering With Optimal.com
-
-Pi-hole will be teaming up with [Rob Leathern's subscription service to avoid ads](https://medium.com/@robleathern/block-ads-on-all-home-devices-for-53-18-a5f1ec139693#.gj1xpgr5d).  This service is unique and will help content-creators and publishers [still make money from visitors who are using an ad ablocker](http://techcrunch.com/2015/12/17/the-new-optimal/).
-
-## Technical Details
-
-The Pi-hole is an **advertising-aware DNS/Web server**.  If an ad domain is queried, a small Web page or GIF is delivered in place of the advertisement.  You can also [replace ads with any image you want](http://pi-hole.net/faq/is-it-possible-to-change-the-blank-page-that-takes-place-of-the-ads-to-something-else/) since it is just a simple Webpage taking place of the ads.
-
-A more detailed explanation of the installation can be found [here](http://jacobsalmela.com/block-millions-ads-network-wide-with-a-raspberry-pi-hole-2-0).
-
-## Gravity
-The [gravity.sh](https://github.com/pi-hole/pi-hole/blob/master/gravity.sh) does most of the magic.  The script pulls in ad domains from many sources and compiles them into a single list of [over 1.6 million entries](http://jacobsalmela.com/block-millions-ads-network-wide-with-a-raspberry-pi-hole-2-0) (if you decide to use the [mahakala list](https://github.com/pi-hole/pi-hole/commit/963eacfe0537a7abddf30441c754c67ca1e40965)).
-
-## Whitelist and blacklist
-Domains can be whitelisted and blacklisted using two pre-installed scripts. See [the wiki page](https://github.com/pi-hole/pi-hole/wiki/Whitelisting-and-Blacklisting) for more details
-
-## Web Interface
-The [Web interface](https://github.com/jacobsalmela/AdminLTE#pi-hole-admin-dashboard) will be installed automatically so you can view stats and change settings.  You can find it at:
-
-`http://192.168.1.x/admin/index.php`
-
-### API
-
-A basic read-only API can be accessed at `/admin/api.php`. It returns the following JSON:
-```JSON
-{
-	"domains_being_blocked": "136708",
-	"dns_queries_today": "18108",
-	"ads_blocked_today": "14648",
-	"ads_percentage_today": "80.89"
-}
 ```
-The same output can be acheived on the CLI by running `chronometer.sh -j`
 
-![Web](http://i.imgur.com/m114SCn.png)
+## Alternative Install Methods
 
-## Real-time Statistics
+Piping to `bash` is [controversial](https://pi-hole.net/2016/07/25/curling-and-piping-to-bash), as it prevents you from [reading code that is about to run](https://github.com/pi-hole/pi-hole/blob/master/automated%20install/basic-install.sh) on your system. Therefore, we provide these alternative installation methods which allow code review before installation:
 
-You can view [real-time stats](http://pi-hole.net/faq/install-the-real-time-lcd-monitor-chronometer/) via `ssh` or on an [2.8" LCD screen](http://amzn.to/1P0q1Fj).  This is accomplished via [`chronometer.sh`](https://github.com/pi-hole/pi-hole/blob/master/advanced/Scripts/chronometer.sh).
+### Method 1: Clone our repository and run
-![Pi-hole LCD](http://i.imgur.com/nBEqycp.jpg)
 
-## Help
+```bash
-- See the [Wiki](https://github.com/pi-hole/pi-hole/wiki/Customization) entry for more details
+git clone --depth 1 https://github.com/pi-hole/pi-hole.git Pi-hole
-- There is also an [FAQ section on pi-hole.net](http://pi-hole.net)
+cd "Pi-hole/automated install/"
+sudo bash basic-install.sh
+```
 
-## Other Operating Systems
+### Method 2: Manually download the installer and run
-This script will work for other UNIX-like systems with some slight **modifications**.  As long as you can install `dnsmasq` and a Webserver, it should work OK.  The automated install only works for a clean install of Raspiban right now since that is how the project originated.
+
+```bash
+wget -O basic-install.sh https://install.pi-hole.net
+sudo bash basic-install.sh
+```
+
+### Method 3: Using Docker to deploy Pi-hole
+
+Please refer to the [Pi-hole docker repo](https://github.com/pi-hole/docker-pi-hole) to use the Official Docker Images.
+
+## [Post-install: Make your network take advantage of Pi-hole](https://docs.pi-hole.net/main/post-install/)
+
+Once the installer has been run, you will need to [configure your router to have **DHCP clients use Pi-hole as their DNS server**](https://discourse.pi-hole.net/t/how-do-i-configure-my-devices-to-use-pi-hole-as-their-dns-server/245). This router configuration will ensure that all devices connecting to your network will have content blocked without any further intervention.
+
+If your router does not support setting the DNS server, you can [use Pi-hole's built-in DHCP server](https://discourse.pi-hole.net/t/how-do-i-use-pi-holes-built-in-dhcp-server-and-why-would-i-want-to/3026); be sure to disable DHCP on your router first (if it has that feature available).
+
+As a last resort, you can manually set each device to use Pi-hole as their DNS server.
+
+-----
+
+## Pi-hole is free but powered by your support
+
+There are many reoccurring costs involved with maintaining free, open-source, and privacy-respecting software; expenses which [our volunteer developers](https://github.com/orgs/pi-hole/people) pitch in to cover out-of-pocket. This is just one example of how strongly we feel about our software and the importance of keeping it maintained.
+
+Make no mistake: **your support is absolutely vital to help keep us innovating!**
+
+### [Donations](https://pi-hole.net/donate)
+
+Donating using our Sponsor Button is **extremely helpful** in offsetting a portion of our monthly expenses:
+
+### Alternative support
+
+If you'd rather not donate (_which is okay!_), there are other ways you can help support us:
+
+- [GitHub Sponsors](https://github.com/sponsors/pi-hole/)
+- [Patreon](https://patreon.com/pihole)
+- [Hetzner Cloud](https://hetzner.cloud/?ref=7aceisRX3AzA) _affiliate link_
+- [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1) _affiliate link_
+- [Stickermule](https://www.stickermule.com/unlock?ref_id=9127301701&utm_medium=link&utm_source=invite) _earn a $10 credit after your first purchase_
+- [Amazon US](https://www.amazon.com/exec/obidos/redirect-home/pihole09-20) _affiliate link_
+- Spreading the word about our software and how you have benefited from it
+
+### Contributing via GitHub
+
+We welcome _everyone_ to contribute to issue reports, suggest new features, and create pull requests.
+
+If you have something to add - anything from a typo through to a whole new feature, we're happy to check it out! Just make sure to fill out our template when submitting your request; the questions it asks will help the volunteers quickly understand what you're aiming to achieve.
+
+You'll find that the [install script](https://github.com/pi-hole/pi-hole/blob/master/automated%20install/basic-install.sh) and the [debug script](https://github.com/pi-hole/pi-hole/blob/master/advanced/Scripts/piholeDebug.sh) have an abundance of comments, which will help you better understand how Pi-hole works. They're also a valuable resource to those who want to learn how to write scripts or code a program! We encourage anyone who likes to tinker to read through it and submit a pull request for us to review.
+
+-----
+
+## Getting in touch with us
+
+While we are primarily reachable on our [Discourse User Forum](https://discourse.pi-hole.net/), we can also be found on various social media outlets.
+
+**Please be sure to check the FAQs** before starting a new discussion, as we do not have the spare time to reply to every request for assistance.
+
+- [Frequently Asked Questions](https://discourse.pi-hole.net/c/faqs)
+- [Feature Requests](https://discourse.pi-hole.net/c/feature-requests?order=votes)
+- [Reddit](https://www.reddit.com/r/pihole/)
+- [Twitter](https://twitter.com/The_Pi_hole)
+
+-----
+
+## Breakdown of Features
+
+### [Faster-than-light Engine](https://github.com/pi-hole/ftl)
+
+[FTLDNS](https://github.com/pi-hole/ftl) is a lightweight, purpose-built daemon used to provide statistics needed for the Web Interface, and its API can be easily integrated into your own projects. As the name implies, FTLDNS does this all _very quickly_!
+
+Some of the statistics you can integrate include:
+
+- Total number of domains being blocked
+- Total number of DNS queries today
+- Total number of ads blocked today
+- Percentage of ads blocked
+- Unique domains
+- Queries forwarded (to your chosen upstream DNS server)
+- Queries cached
+- Unique clients
+
+Access the API via [`telnet`](https://github.com/pi-hole/FTL), the Web (`admin/api.php`) and Command Line (`pihole -c -j`). You can find out [more details over here](https://discourse.pi-hole.net/t/pi-hole-api/1863).
+
+### The Command-Line Interface
+
+The [pihole](https://docs.pi-hole.net/core/pihole-command/) command has all the functionality necessary to fully administer the Pi-hole, without the need for the Web Interface. It's fast, user-friendly, and auditable by anyone with an understanding of `bash`.
+
+Some notable features include:
+
+- [Whitelisting, Blacklisting, and Regex](https://docs.pi-hole.net/core/pihole-command/#whitelisting-blacklisting-and-regex)
+- [Debugging utility](https://docs.pi-hole.net/core/pihole-command/#debugger)
+- [Viewing the live log file](https://docs.pi-hole.net/core/pihole-command/#tail)
+- [Updating Ad Lists](https://docs.pi-hole.net/core/pihole-command/#gravity)
+- [Querying Ad Lists for blocked domains](https://docs.pi-hole.net/core/pihole-command/#query)
+- [Enabling and Disabling Pi-hole](https://docs.pi-hole.net/core/pihole-command/#enable-disable)
+- ... and _many_ more!
+
+You can read our [Core Feature Breakdown](https://docs.pi-hole.net/core/pihole-command/#pi-hole-core) for more information.
+
+### The Web Interface Dashboard
+
+This [optional dashboard](https://github.com/pi-hole/web) allows you to view stats, change settings, and configure your Pi-hole. It's the power of the Command Line Interface, with none of the learning curve!
+
+Some notable features include:
+
+- Mobile-friendly interface
+- Password protection
+- Detailed graphs and doughnut charts
+- Top lists of domains and clients
+- A filterable and sortable query log
+- Long Term Statistics to view data over user-defined time ranges
+- The ability to easily manage and configure Pi-hole features
+- ... and all the main features of the Command Line Interface!
+
+There are several ways to [access the dashboard](https://discourse.pi-hole.net/t/how-do-i-access-pi-holes-dashboard-admin-interface/3168):
+
+1. `http://pi.hole/admin/` (when using Pi-hole as your DNS server)
+2. `http://<IP_ADDRESS_OF_YOUR_PI_HOLE>/admin/`

advanced/Scripts/COL_TABLE

@@ -0,0 +1,49 @@
+# Determine if terminal is capable of showing colors
+if ([ -t 1 ] && [ $(tput colors) -ge 8 ]) || [ "${WEBCALL}" ]; then
+  # Bold and underline may not show up on all clients
+  # If something MUST be emphasized, use both
+  COL_BOLD=''
+  COL_ULINE=''
+
+  COL_NC=''
+  COL_GRAY=''
+  COL_RED=''
+  COL_GREEN=''
+  COL_YELLOW=''
+  COL_BLUE=''
+  COL_PURPLE=''
+  COL_CYAN=''
+else
+  # Provide empty variables for `set -u`
+  COL_BOLD=""
+  COL_ULINE=""
+
+  COL_NC=""
+  COL_GRAY=""
+  COL_RED=""
+  COL_GREEN=""
+  COL_YELLOW=""
+  COL_BLUE=""
+  COL_PURPLE=""
+  COL_CYAN=""
+fi
+
+# Deprecated variables
+COL_WHITE="${COL_BOLD}"
+COL_BLACK="${COL_NC}"
+COL_LIGHT_BLUE="${COL_BLUE}"
+COL_LIGHT_GREEN="${COL_GREEN}"
+COL_LIGHT_CYAN="${COL_CYAN}"
+COL_LIGHT_RED="${COL_RED}"
+COL_URG_RED="${COL_RED}${COL_BOLD}${COL_ULINE}"
+COL_LIGHT_PURPLE="${COL_PURPLE}"
+COL_BROWN="${COL_YELLOW}"
+COL_LIGHT_GRAY="${COL_GRAY}"
+COL_DARK_GRAY="${COL_GRAY}"
+
+TICK="[${COL_GREEN}✓${COL_NC}]"
+CROSS="[${COL_RED}✗${COL_NC}]"
+INFO="[i]"
+QST="[?]"
+DONE="${COL_GREEN} done!${COL_NC}"
+OVER="\\r"

advanced/Scripts/api.sh

@@ -0,0 +1,290 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC3043 #https://github.com/koalaman/shellcheck/wiki/SC3043#exceptions
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Script to hold api functions for use in other scripts
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+
+# The basic usage steps are
+# 1) Test Availability of the API
+# 2) Try to authenticate (read password if needed)
+# 3) Get the data from the API endpoint
+# 4) Delete the session
+
+
+TestAPIAvailability() {
+
+    # as we are running locally, we can get the port value from FTL directly
+    local chaos_api_list availabilityResponse
+
+    # Query the API URLs from FTL using CHAOS TXT local.api.ftl
+    # The result is a space-separated enumeration of full URLs
+    # e.g., "http://localhost:80/api/" "https://localhost:443/api/"
+    chaos_api_list="$(dig +short chaos txt local.api.ftl @127.0.0.1)"
+
+    # If the query was not successful, the variable is empty
+    if [ -z "${chaos_api_list}" ]; then
+        echo "API not available. Please check connectivity"
+        exit 1
+    fi
+
+    # Iterate over space-separated list of URLs
+    while [ -n "${chaos_api_list}" ]; do
+        # Get the first URL
+        API_URL="${chaos_api_list%% *}"
+        # Strip leading and trailing quotes
+        API_URL="${API_URL%\"}"
+        API_URL="${API_URL#\"}"
+
+        # Test if the API is available at this URL
+        availabilityResponse=$(curl -skS -o /dev/null -w "%{http_code}" "${API_URL}auth")
+
+        # Test if http status code was 200 (OK) or 401 (authentication required)
+        if [ ! "${availabilityResponse}" = 200 ] && [ ! "${availabilityResponse}" = 401 ]; then
+            # API is not available at this port/protocol combination
+            API_PORT=""
+        else
+            # API is available at this URL combination
+
+            if [ "${availabilityResponse}" = 200 ]; then
+                # API is available without authentication
+                needAuth=false
+            fi
+
+            break
+        fi
+
+        # Remove the first URL from the list
+        local last_api_list
+        last_api_list="${chaos_api_list}"
+        chaos_api_list="${chaos_api_list#* }"
+
+        # If the list did not change, we are at the last element
+        if [ "${last_api_list}" = "${chaos_api_list}" ]; then
+            # Remove the last element
+            chaos_api_list=""
+        fi
+    done
+
+    # if API_PORT is empty, no working API port was found
+    if [ -n "${API_PORT}" ]; then
+        echo "API not available at: ${API_URL}"
+        echo "Exiting."
+        exit 1
+    fi
+}
+
+LoginAPI() {
+    # If the API URL is not set, test the availability
+    if [ -z "${API_URL}" ]; then
+        TestAPIAvailability
+    fi
+
+    # Exit early if authentication is not needed
+    if [ "${needAuth}" = false ]; then
+        if [ "${1}" = "verbose" ]; then
+            echo "API Authentication: Not needed"
+        fi
+        return
+    fi
+
+    # Try to read the CLI password (if enabled and readable by the current user)
+    if [ -r /etc/pihole/cli_pw ]; then
+        password=$(cat /etc/pihole/cli_pw)
+
+        if [ "${1}" = "verbose" ]; then
+            echo "API Authentication: Trying to use CLI password"
+        fi
+
+        # Try to authenticate using the CLI password
+        Authentication "${1}"
+
+    elif [ "${1}" = "verbose" ]; then
+        echo "API Authentication: CLI password not available"
+    fi
+
+
+
+    # If this did not work, ask the user for the password
+    while [ "${validSession}" = false ] || [ -z "${validSession}" ] ; do
+        echo "Authentication failed. Please enter your Pi-hole password"
+
+        # secretly read the password
+        secretRead; printf '\n'
+
+        # Try to authenticate again
+        Authentication "${1}"
+    done
+
+}
+
+Authentication() {
+  sessionResponse="$(curl -skS -X POST "${API_URL}auth" --user-agent "Pi-hole cli " --data "{\"password\":\"${password}\"}" )"
+
+  if [ -z "${sessionResponse}" ]; then
+    echo "No response from FTL server. Please check connectivity"
+    exit 1
+  fi
+  # obtain validity and session ID from session response
+  validSession=$(echo "${sessionResponse}"| jq .session.valid 2>/dev/null)
+  SID=$(echo "${sessionResponse}"| jq --raw-output .session.sid 2>/dev/null)
+
+  if [ "${1}" = "verbose" ]; then
+    if [ "${validSession}" = true ]; then
+      echo "API Authentication: ${COL_GREEN}Success${COL_NC}"
+    else
+      echo "API Authentication: ${COL_RED}Failed${COL_NC}"
+    fi
+  fi
+}
+
+LogoutAPI() {
+    # if a valid Session exists (no password required or successful Authentication) and
+    # SID is not null (successful Authentication only), delete the session
+    if [ "${validSession}" = true ] && [ ! "${SID}" = null ]; then
+        # Try to delete the session. Omit the output, but get the http status code
+        deleteResponse=$(curl -skS -o /dev/null -w "%{http_code}" -X DELETE "${API_URL}auth"  -H "Accept: application/json" -H "sid: ${SID}")
+
+        case "${deleteResponse}" in
+            "401") echo "Logout attempt without a valid session. Unauthorized!";;
+            "204") if [ "${1}" = "verbose" ]; then echo "API Logout: ${COL_GREEN}Success${COL_NC} (session deleted)"; fi;;
+        esac;
+    elif [ "${1}" = "verbose" ]; then
+        echo "API Logout: ${COL_GREEN}Success${COL_NC} (no valid session)"
+    fi
+}
+
+GetFTLData() {
+  local data response status
+  # get the data from querying the API as well as the http status code
+  response=$(curl -skS -w "%{http_code}" -X GET "${API_URL}$1" -H "Accept: application/json" -H "sid: ${SID}" )
+
+  # status are the last 3 characters
+  status="${response#"${response%???}"}"
+  # data is everything from response without the last 3 characters
+  data="${response%???}"
+
+  if [ "${2}" = "raw" ]; then
+    # return the raw response
+    echo "${response}"
+  else
+    # return only the data
+    if [ "${status}" = 200 ]; then
+        # response OK
+        echo "${data}"
+    else
+        # connection lost
+        echo "${status}"
+    fi
+  fi
+}
+
+PostFTLData() {
+  local data response status
+  # send the data to the API
+  response=$(curl -skS -w "%{http_code}" -X POST "${API_URL}$1" --data-raw "$2" -H "Accept: application/json" -H "sid: ${SID}" )
+  # data is everything from response without the last 3 characters
+  if [ "${3}" = "status" ]; then
+    # Keep the status code appended if requested
+    printf %s "${response}"
+  else
+    # Strip the status code
+    printf %s "${response%???}"
+  fi
+}
+
+secretRead() {
+
+    # POSIX compliant function to read user-input and
+    # mask every character entered by (*)
+    #
+    # This is challenging, because in POSIX, `read` does not support
+    # `-s` option (suppressing the input) or
+    # `-n` option (reading n chars)
+
+
+    # This workaround changes the terminal characteristics to not echo input and later resets this option
+    # credits https://stackoverflow.com/a/4316765
+    # showing asterisk instead of password
+    # https://stackoverflow.com/a/24600839
+    # https://unix.stackexchange.com/a/464963
+
+
+    # Save current terminal settings (needed for later restore after password prompt)
+    stty_orig=$(stty -g)
+
+    stty -echo # do not echo user input
+    stty -icanon min 1 time 0 # disable canonical mode https://man7.org/linux/man-pages/man3/termios.3.html
+
+    unset password
+    unset key
+    unset charcount
+    charcount=0
+    while key=$(dd ibs=1 count=1 2>/dev/null); do #read one byte of input
+        if [ "${key}" = "$(printf '\0' | tr -d '\0')" ] ; then
+            # Enter - accept password
+            break
+        fi
+        if [ "${key}" = "$(printf '\177')" ] ; then
+            # Backspace
+            if [ $charcount -gt 0 ] ; then
+                charcount=$((charcount-1))
+                printf '\b \b'
+                password="${password%?}"
+            fi
+        else
+            # any other character
+            charcount=$((charcount+1))
+            printf '*'
+            password="$password$key"
+        fi
+    done
+
+    # restore original terminal settings
+    stty "${stty_orig}"
+}
+
+apiFunc() {
+  local data response status status_col
+
+  # Authenticate with the API
+  LoginAPI verbose
+  echo ""
+
+  echo "Requesting: ${COL_PURPLE}GET ${COL_CYAN}${API_URL}${COL_YELLOW}$1${COL_NC}"
+  echo ""
+
+  # Get the data from the API
+  response=$(GetFTLData "$1" raw)
+
+  # status are the last 3 characters
+  status="${response#"${response%???}"}"
+  # data is everything from response without the last 3 characters
+  data="${response%???}"
+
+  # Output the status (200 -> green, else red)
+  if [ "${status}" = 200 ]; then
+    status_col="${COL_GREEN}"
+  else
+    status_col="${COL_RED}"
+  fi
+  echo "Status: ${status_col}${status}${COL_NC}"
+
+  # Output the data. Format it with jq if available and data is actually JSON.
+  # Otherwise just print it
+  echo "Data:"
+  if command -v jq >/dev/null && echo "${data}" | jq . >/dev/null 2>&1; then
+    echo "${data}" | jq .
+  else
+    echo "${data}"
+  fi
+
+  # Delete the session
+  LogoutAPI verbose
+}

advanced/Scripts/blacklist.sh

@@ -1,191 +0,0 @@
-#!/usr/bin/env bash
-# (c) 2015 by Jacob Salmela
-# This file is part of Pi-hole.
-#
-# Pi-hole is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-
-if [[ $# = 0 ]]; then
-    echo "Immediately blacklists one or more domains in the hosts file"
-    echo " "
-    echo "Usage: blacklist.sh domain1 [domain2 ...]"
-    echo "  "
-    echo "Options:"
-    echo "  -d, --delmode		Remove domains from the blacklist"
-    echo "  -nr, --noreload	Update blacklist without refreshing dnsmasq"
-    echo "  -f, --force		Force updating of the hosts files, even if there are no changes"
-    echo "  -q, --quiet		output is less verbose"
-    exit 1
-fi
-
-#globals
-blacklist=/etc/pihole/blacklist.txt
-adList=/etc/pihole/gravity.list
-reload=true
-addmode=true
-force=false
-versbose=true
-domList=()
-domToRemoveList=()
-
-
-piholeIPfile=/tmp/piholeIP
-piholeIPv6file=/etc/pihole/.useIPv6
-
-# Otherwise, the IP address can be taken directly from the machine, which will happen when the script is run by the user and not the installation script
-IPv4dev=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}')
-piholeIPCIDR=$(ip -o -f inet addr show dev $IPv4dev | awk '{print $4}' | awk 'END {print}')
-piholeIP=${piholeIPCIDR%/*}
-
-modifyHost=false
-
-
-if [[ -f $piholeIPv6file ]];then
-    # If the file exists, then the user previously chose to use IPv6 in the automated installer
-    piholeIPv6=$(ip -6 route get 2001:4860:4860::8888 | awk -F " " '{ for(i=1;i<=NF;i++) if ($i == "src") print $(i+1) }')
-fi
-
-
-function HandleOther(){	
-  #check validity of domain
-	validDomain=$(echo $1 | perl -ne'print if /\b((?=[a-z0-9-]{1,63}\.)(xn--)?[a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,63}\b/')
-	
-	if [ -z "$validDomain" ]; then
-		echo $1 is not a valid argument or domain name
-	else	  
-	  domList=("${domList[@]}" $validDomain)
-	fi
-}
-
-function PopBlacklistFile(){
-	#check blacklist file exists, and if not, create it
-	if [[ ! -f $blacklist ]];then
-  	  touch $blacklist
-	fi	
-	for dom in "${domList[@]}"
-	do	  
-	  if $addmode; then
-	  	AddDomain $dom
-	  else
-	    RemoveDomain $dom
-	  fi
-	done
-}
-
-function AddDomain(){
-#| sed 's/\./\\./g'
-	bool=false
-	grep -Ex -q "$1" $blacklist || bool=true
-	if $bool; then
-	  #domain not found in the blacklist file, add it!
-	  if $versbose; then
-	  echo -n "::: Adding $1 to blacklist file..."
-	  fi
-		echo $1 >> $blacklist
-		modifyHost=true
-		echo " done!"
-	else
-	if $versbose; then
-		echo "::: $1 already exists in blacklist.txt! No need to add"
-		fi
-	fi
-}
-
-function RemoveDomain(){
-  
-  bool=false
-  grep -Ex -q "$1" $blacklist || bool=true
-  if $bool; then
-  	#Domain is not in the blacklist file, no need to Remove
-  	if $versbose; then
-  	echo "::: $1 is NOT blacklisted! No need to remove"
-  	fi
-  else
-    #Domain is in the blacklist file, add to a temporary array
-    if $versbose; then
-    echo "::: Un-blacklisting $dom..."
-    fi
-    domToRemoveList=("${domToRemoveList[@]}" $1)    
-    modifyHost=true	  	
-  fi  	
-}
-
-function ModifyHostFile(){	
-	 if $addmode; then
-	    #add domains to the hosts file
-	    if [[ -r $blacklist ]];then
-	      numberOf=$(cat $blacklist | sed '/^\s*$/d' | wc -l)
-        plural=; [[ "$numberOf" != "1" ]] && plural=s
-        echo ":::"
-        echo -n "::: Modifying HOSTS file to blacklist $numberOf domain${plural}..."	   		    
-	    	if [[ -n $piholeIPv6 ]];then	    	  
-	    	  cat $blacklist | awk -v ipv4addr="$piholeIP" -v ipv6addr="$piholeIPv6" '{sub(/\r$/,""); print ipv4addr" "$0"\n"ipv6addr" "$0}' >> $adList
-	      else	        
-	      	cat $blacklist | awk -v ipv4addr="$piholeIP" '{sub(/\r$/,""); print ipv4addr" "$0}' >>$adList
-	      fi		    
-		   
-	  	fi
-	  else
-		
-		echo ":::"
-	  for dom in "${domToRemoveList[@]}"
-		do	  
-	      #we need to remove the domains from the blacklist file and the host file	     
-				echo "::: $dom"
-				echo -n ":::    removing from HOSTS file..."
-	      echo $dom | sed 's/\./\\./g' | xargs -I {} perl -i -ne'print unless /[^.]'{}'(?!.)/;' $adList  
-	      echo " done!"
-	      echo -n ":::    removing from blackist.txt..."
-	      echo $dom | sed 's/\./\\./g' | xargs -I {} perl -i -ne'print unless /'{}'(?!.)/;' $blacklist
-	      echo " done!"
-		done	  
-		fi
-	  
-}
-
-function Reload() {
-	# Reload hosts file
-	echo ":::"
-	echo -n "::: Refresh lists in dnsmasq..."
-
-	dnsmasqPid=$(pidof dnsmasq)
-
-	if [[ $dnsmasqPid ]]; then
-		# service already running - reload config
-		sudo kill -HUP $dnsmasqPid
-	else
-		# service not running, start it up
-		sudo service dnsmasq start
-	fi
-	echo " done!"
-}
-
-###################################################
-
-for var in "$@"
-do
-  case "$var" in
-    "-nr"| "--noreload"  ) reload=false;;        			
-    "-d" | "--delmode"   ) addmode=false;;
-    "-f" | "--force"     ) force=true;;
-    "-q" | "--quiet"     ) versbose=false;;  			
-    *                    ) HandleOther $var;;
-  esac
-done
-
-PopBlacklistFile
-
-if $modifyHost || $force; then	
-	ModifyHostFile
-else
-  if $versbose; then
-	echo "::: No changes need to be made"
-	fi
-	exit 1
-fi
-
-if $reload; then
-	Reload
-fi

advanced/Scripts/chronometer.sh

@@ -1,135 +0,0 @@
-#!/usr/bin/env bash
-# (c) 2015 by Jacob Salmela
-# This file is part of Pi-hole.
-#
-# Pi-hole is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-
-
-#Functions##############################################################################################################
-piLog="/var/log/pihole.log"
-gravity="/etc/pihole/gravity.list"
-
-today=$(date "+%b %e")
-
-function CalcBlockedDomains(){
-	CheckIPv6
-	if [ -e "$gravity" ]; then
-		#Are we IPV6 or IPV4?
-		if [[ -n $piholeIPv6 ]];then
-			#We are IPV6
-			blockedDomainsTotal=$(wc -l /etc/pihole/gravity.list | awk '{print $1/2}')
-		else
-			#We are IPV4
-			blockedDomainsTotal=$(wc -l /etc/pihole/gravity.list | awk '{print $1}')
-		fi
-	else
-		blockedDomainsTotal="Err."
-	fi
-}
-
-function CalcQueriesToday(){
-	if [ -e "$piLog" ];then
-		queriesToday=$(cat "$piLog" | grep "$today" | awk '/query/ {print $6}' | wc -l)
-	else
-		queriesToday="Err."
-	fi
-}
-
-function CalcblockedToday(){
-	if [ -e "$piLog" ] && [ -e "$gravity" ];then
-		blockedToday=$(cat $piLog | awk '/\/etc\/pihole\/gravity.list/ && !/address/ {print $6}' | wc -l)
-	else
-		blockedToday="Err."
-	fi
-}
-
-function CalcPercentBlockedToday(){
-	if [ "$queriesToday" != "Err." ] && [ "$blockedToday" != "Err." ]; then
-		#scale 2 rounds the number down, so we'll do scale 4 and then trim the last 2 zeros
-		percentBlockedToday=$(echo "scale=4; $blockedToday/$queriesToday*100" | bc)		
-		percentBlockedToday=$(sed 's/.\{2\}$//' <<< "$percentBlockedToday")		
-	fi
-}
-
-function CheckIPv6(){
-	piholeIPv6file="/etc/pihole/.useIPv6"
-	if [[ -f $piholeIPv6file ]];then
-	    # If the file exists, then the user previously chose to use IPv6 in the automated installer
-	    piholeIPv6=$(ip -6 route get 2001:4860:4860::8888 | awk -F " " '{ for(i=1;i<=NF;i++) if ($i == "src") print $(i+1) }')
-	fi
-}
-
-function outputJSON(){
-	CalcQueriesToday
-	CalcblockedToday
-	CalcPercentBlockedToday
-	
-	CalcBlockedDomains
-	
-	printf '{"domains_being_blocked":"%s","dns_queries_today":"%s","ads_blocked_today":"%s","ads_percentage_today":"%s"}\n' "$blockedDomainsTotal" "$queriesToday" "$blockedToday" "$percentBlockedToday"
-}
-
-function normalChrono(){
-	for (( ; ; ))
-	do
-		clear
-		# Displays a colorful Pi-hole logo
-		toilet -f small -F gay Pi-hole
-		echo "        $(ifconfig eth0 | awk '/inet addr/ {print $2}' | cut -d':' -f2)"
-		echo ""
-		uptime | cut -d' ' -f11-
-		echo "-------------------------------"
-		# Uncomment to continually read the log file and display the current domain being blocked
-		#tail -f /var/log/pihole.log | awk '/\/etc\/pihole\/gravity.list/ {if ($7 != "address" && $7 != "name" && $7 != "/etc/pihole/gravity.list") print $7; else;}'
-		
-		#uncomment next 4 lines to use original query count calculation
-		#today=$(date "+%b %e")
-		#todaysQueryCount=$(cat /var/log/pihole.log | grep "$today" | awk '/query/ {print $7}' | wc -l)
-		#todaysQueryCountV4=$(cat /var/log/pihole.log | grep "$today" | awk '/query/ && /\[A\]/ {print $7}' | wc -l)
-		#todaysQueryCountV6=$(cat /var/log/pihole.log | grep "$today" | awk '/query/ && /\[AAAA\]/ {print $7}' | wc -l)
-				
-		
-		CalcQueriesToday
-		CalcblockedToday
-		CalcPercentBlockedToday
-		
-		CalcBlockedDomains
-		
-		echo "Blocking:      $blockedDomainsTotal"
-		#below commented line does not add up to todaysQueryCount
-		#echo "Queries:       $todaysQueryCountV4 / $todaysQueryCountV6"
-		echo "Queries:       $queriesToday" #same total calculation as dashboard
-	  echo "Pi-holed:      $blockedToday ($percentBlockedToday%)"
-		
-		sleep 5
-	done
-}
-
-function displayHelp(){
- echo "Displays stats about your piHole!"
-    echo " "
-    echo "Usage: chronometer.sh [optional:-j]"
-    echo "Note: If no option is passed, then stats are displayed on screen, updated every 5 seconds"
-    echo "  "
-    echo "Options:"
-    echo "  -j, --json		output stats as JSON formatted string"
-    echo "  -h, --help	display this help text"
-    
-    exit 1
-}
-
-if [[ $# = 0 ]]; then
-	normalChrono
-fi
-
-for var in "$@"
-do
-  case "$var" in
-    "-j" | "--json"  ) outputJSON;;
-    "-h" | "--help"  ) displayHelp;;        			
-    *                ) exit 1;;
-  esac
-done

advanced/Scripts/database_migration/gravity-db.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC1090
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2019 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Updates gravity.db database
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+readonly scriptPath="/etc/.pihole/advanced/Scripts/database_migration/gravity"
+
+upgrade_gravityDB(){
+    local database piholeDir version
+    database="${1}"
+    piholeDir="${2}"
+
+    # Exit early if the database does not exist (e.g. in CI tests)
+    if [[ ! -f "${database}" ]]; then
+        return
+    fi
+
+    # Get database version
+    version="$(pihole-FTL sqlite3 -ni "${database}" "SELECT \"value\" FROM \"info\" WHERE \"property\" = 'version';")"
+
+    if [[ "$version" == "1" ]]; then
+        # This migration script upgraded the gravity.db file by
+        # adding the domain_audit table. It is now a no-op
+        echo -e "  ${INFO} Upgrading gravity database from version 1 to 2"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/1_to_2.sql"
+        version=2
+    fi
+    if [[ "$version" == "2" ]]; then
+        # This migration script upgrades the gravity.db file by
+        # renaming the regex table to regex_blacklist, and
+        # creating a new regex_whitelist table + corresponding linking table and views
+        echo -e "  ${INFO} Upgrading gravity database from version 2 to 3"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/2_to_3.sql"
+        version=3
+    fi
+    if [[ "$version" == "3" ]]; then
+        # This migration script unifies the formally separated domain
+        # lists into a single table with a UNIQUE domain constraint
+        echo -e "  ${INFO} Upgrading gravity database from version 3 to 4"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/3_to_4.sql"
+        version=4
+    fi
+    if [[ "$version" == "4" ]]; then
+        # This migration script upgrades the gravity and list views
+        # implementing necessary changes for per-client blocking
+        echo -e "  ${INFO} Upgrading gravity database from version 4 to 5"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/4_to_5.sql"
+        version=5
+    fi
+    if [[ "$version" == "5" ]]; then
+        # This migration script upgrades the adlist view
+        # to return an ID used in gravity.sh
+        echo -e "  ${INFO} Upgrading gravity database from version 5 to 6"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/5_to_6.sql"
+        version=6
+    fi
+    if [[ "$version" == "6" ]]; then
+        # This migration script adds a special group with ID 0
+        # which is automatically associated to all clients not
+        # having their own group assignments
+        echo -e "  ${INFO} Upgrading gravity database from version 6 to 7"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/6_to_7.sql"
+        version=7
+    fi
+    if [[ "$version" == "7" ]]; then
+        # This migration script recreated the group table
+        # to ensure uniqueness on the group name
+        # We also add date_added and date_modified columns
+        echo -e "  ${INFO} Upgrading gravity database from version 7 to 8"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/7_to_8.sql"
+        version=8
+    fi
+    if [[ "$version" == "8" ]]; then
+        # This migration fixes some issues that were introduced
+        # in the previous migration script.
+        echo -e "  ${INFO} Upgrading gravity database from version 8 to 9"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/8_to_9.sql"
+        version=9
+    fi
+    if [[ "$version" == "9" ]]; then
+        # This migration drops unused tables and creates triggers to remove
+        # obsolete groups assignments when the linked items are deleted
+        echo -e "  ${INFO} Upgrading gravity database from version 9 to 10"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/9_to_10.sql"
+        version=10
+    fi
+    if [[ "$version" == "10" ]]; then
+        # This adds timestamp and an optional comment field to the client table
+        # These fields are only temporary and will be replaces by the columns
+        # defined in gravity.db.sql during gravity swapping. We add them here
+        # to keep the copying process generic (needs the same columns in both the
+        # source and the destination databases).
+        echo -e "  ${INFO} Upgrading gravity database from version 10 to 11"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/10_to_11.sql"
+        version=11
+    fi
+    if [[ "$version" == "11" ]]; then
+        # Rename group 0 from "Unassociated" to "Default"
+        echo -e "  ${INFO} Upgrading gravity database from version 11 to 12"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/11_to_12.sql"
+        version=12
+    fi
+    if [[ "$version" == "12" ]]; then
+        # Add column date_updated to adlist table
+        echo -e "  ${INFO} Upgrading gravity database from version 12 to 13"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/12_to_13.sql"
+        version=13
+    fi
+    if [[ "$version" == "13" ]]; then
+        # Add columns number and status to adlist table
+        echo -e "  ${INFO} Upgrading gravity database from version 13 to 14"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/13_to_14.sql"
+        version=14
+    fi
+    if [[ "$version" == "14" ]]; then
+        # Changes the vw_adlist created in 5_to_6
+        echo -e "  ${INFO} Upgrading gravity database from version 14 to 15"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/14_to_15.sql"
+        version=15
+    fi
+    if [[ "$version" == "15" ]]; then
+        # Add column abp_entries to adlist table
+        echo -e "  ${INFO} Upgrading gravity database from version 15 to 16"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/15_to_16.sql"
+        version=16
+    fi
+    if [[ "$version" == "16" ]]; then
+        # Add antigravity table
+        # Add column type to adlist table (to support adlist types)
+        echo -e "  ${INFO} Upgrading gravity database from version 16 to 17"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/16_to_17.sql"
+        version=17
+    fi
+    if [[ "$version" == "17" ]]; then
+        # Add adlist.id to vw_gravity and vw_antigravity
+        echo -e "  ${INFO} Upgrading gravity database from version 17 to 18"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/17_to_18.sql"
+        version=18
+    fi
+    if [[ "$version" == "18" ]]; then
+        # Modify DELETE triggers to delete BEFORE instead of AFTER to prevent
+        # foreign key constraint violations
+        echo -e "  ${INFO} Upgrading gravity database from version 18 to 19"
+        pihole-FTL sqlite3 -ni "${database}" < "${scriptPath}/18_to_19.sql"
+        version=19
+    fi
+}

advanced/Scripts/database_migration/gravity/10_to_11.sql

@@ -0,0 +1,16 @@
+.timeout 30000
+
+BEGIN TRANSACTION;
+
+ALTER TABLE client ADD COLUMN date_added INTEGER;
+ALTER TABLE client ADD COLUMN date_modified INTEGER;
+ALTER TABLE client ADD COLUMN comment TEXT;
+
+CREATE TRIGGER tr_client_update AFTER UPDATE ON client
+    BEGIN
+      UPDATE client SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+UPDATE info SET value = 11 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/11_to_12.sql

@@ -0,0 +1,19 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+UPDATE "group" SET name = 'Default' WHERE id = 0;
+UPDATE "group" SET description = 'The default group' WHERE id = 0;
+
+DROP TRIGGER IF EXISTS tr_group_zero;
+
+CREATE TRIGGER tr_group_zero AFTER DELETE ON "group"
+    BEGIN
+      INSERT OR IGNORE INTO "group" (id,enabled,name,description) VALUES (0,1,'Default','The default group');
+    END;
+
+UPDATE info SET value = 12 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/12_to_13.sql

@@ -0,0 +1,18 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE adlist ADD COLUMN date_updated INTEGER;
+
+DROP TRIGGER tr_adlist_update;
+
+CREATE TRIGGER tr_adlist_update AFTER UPDATE OF address,enabled,comment ON adlist
+    BEGIN
+      UPDATE adlist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+UPDATE info SET value = 13 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/13_to_14.sql

@@ -0,0 +1,13 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE adlist ADD COLUMN number INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE adlist ADD COLUMN invalid_domains INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE adlist ADD COLUMN status INTEGER NOT NULL DEFAULT 0;
+
+UPDATE info SET value = 14 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/14_to_15.sql

@@ -0,0 +1,15 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+DROP VIEW vw_adlist;
+
+CREATE VIEW vw_adlist AS SELECT DISTINCT address, id
+    FROM adlist
+    WHERE enabled = 1
+    ORDER BY id;
+
+UPDATE info SET value = 15 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/15_to_16.sql

@@ -0,0 +1,11 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE adlist ADD COLUMN abp_entries INTEGER NOT NULL DEFAULT 0;
+
+UPDATE info SET value = 16 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/16_to_17.sql

@@ -0,0 +1,33 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE adlist ADD COLUMN type INTEGER NOT NULL DEFAULT 0;
+
+UPDATE adlist SET type = 0;
+
+CREATE TABLE IF NOT EXISTS antigravity
+(
+    domain TEXT NOT NULL,
+    adlist_id INTEGER NOT NULL REFERENCES adlist (id)
+);
+
+CREATE VIEW vw_antigravity AS SELECT domain, adlist_by_group.group_id AS group_id
+    FROM antigravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = antigravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = antigravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1) AND adlist.type = 1;
+
+DROP VIEW vw_adlist;
+
+CREATE VIEW vw_adlist AS SELECT DISTINCT address, id, type
+    FROM adlist
+    WHERE enabled = 1
+    ORDER BY id;
+
+UPDATE info SET value = 17 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/17_to_18.sql

@@ -0,0 +1,25 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP VIEW vw_gravity;
+CREATE VIEW vw_gravity AS SELECT domain, adlist.id AS adlist_id, adlist_by_group.group_id AS group_id
+    FROM gravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = gravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = gravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1);
+
+DROP VIEW vw_antigravity;
+CREATE VIEW vw_antigravity AS SELECT domain, adlist.id AS adlist_id, adlist_by_group.group_id AS group_id
+    FROM antigravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = antigravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = antigravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1) AND adlist.type = 1;
+
+UPDATE info SET value = 18 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/18_to_19.sql

@@ -0,0 +1,27 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP TRIGGER tr_domainlist_delete;
+CREATE TRIGGER tr_domainlist_delete BEFORE DELETE ON domainlist
+    BEGIN
+      DELETE FROM domainlist_by_group WHERE domainlist_id = OLD.id;
+    END;
+
+DROP TRIGGER tr_adlist_delete;
+CREATE TRIGGER tr_adlist_delete BEFORE DELETE ON adlist
+    BEGIN
+      DELETE FROM adlist_by_group WHERE adlist_id = OLD.id;
+    END;
+
+DROP TRIGGER tr_client_delete;
+CREATE TRIGGER tr_client_delete BEFORE DELETE ON client
+    BEGIN
+      DELETE FROM client_by_group WHERE client_id = OLD.id;
+    END;
+
+UPDATE info SET value = 19 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/1_to_2.sql

@@ -0,0 +1,7 @@
+.timeout 30000
+
+BEGIN TRANSACTION;
+
+UPDATE info SET value = 2 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/2_to_3.sql

@@ -0,0 +1,65 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE regex RENAME TO regex_blacklist;
+
+CREATE TABLE regex_blacklist_by_group
+(
+    regex_blacklist_id INTEGER NOT NULL REFERENCES regex_blacklist (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (regex_blacklist_id, group_id)
+);
+
+INSERT INTO regex_blacklist_by_group SELECT * FROM regex_by_group;
+DROP TABLE regex_by_group;
+DROP VIEW vw_regex;
+DROP TRIGGER tr_regex_update;
+
+CREATE VIEW vw_regex_blacklist AS SELECT DISTINCT domain
+    FROM regex_blacklist
+    LEFT JOIN regex_blacklist_by_group ON regex_blacklist_by_group.regex_blacklist_id = regex_blacklist.id
+    LEFT JOIN "group" ON "group".id = regex_blacklist_by_group.group_id
+    WHERE regex_blacklist.enabled = 1 AND (regex_blacklist_by_group.group_id IS NULL OR "group".enabled = 1)
+    ORDER BY regex_blacklist.id;
+
+CREATE TRIGGER tr_regex_blacklist_update AFTER UPDATE ON regex_blacklist
+    BEGIN
+      UPDATE regex_blacklist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE domain = NEW.domain;
+    END;
+
+CREATE TABLE regex_whitelist
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    domain TEXT UNIQUE NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    comment TEXT
+);
+
+CREATE TABLE regex_whitelist_by_group
+(
+    regex_whitelist_id INTEGER NOT NULL REFERENCES regex_whitelist (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (regex_whitelist_id, group_id)
+);
+
+CREATE VIEW vw_regex_whitelist AS SELECT DISTINCT domain
+    FROM regex_whitelist
+    LEFT JOIN regex_whitelist_by_group ON regex_whitelist_by_group.regex_whitelist_id = regex_whitelist.id
+    LEFT JOIN "group" ON "group".id = regex_whitelist_by_group.group_id
+    WHERE regex_whitelist.enabled = 1 AND (regex_whitelist_by_group.group_id IS NULL OR "group".enabled = 1)
+    ORDER BY regex_whitelist.id;
+
+CREATE TRIGGER tr_regex_whitelist_update AFTER UPDATE ON regex_whitelist
+    BEGIN
+      UPDATE regex_whitelist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE domain = NEW.domain;
+    END;
+
+
+UPDATE info SET value = 3 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/3_to_4.sql

@@ -0,0 +1,96 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+CREATE TABLE domainlist
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    type INTEGER NOT NULL DEFAULT 0,
+    domain TEXT UNIQUE NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    comment TEXT
+);
+
+ALTER TABLE whitelist ADD COLUMN type INTEGER;
+UPDATE whitelist SET type = 0;
+INSERT INTO domainlist (type,domain,enabled,date_added,date_modified,comment)
+    SELECT type,domain,enabled,date_added,date_modified,comment FROM whitelist;
+
+ALTER TABLE blacklist ADD COLUMN type INTEGER;
+UPDATE blacklist SET type = 1;
+INSERT INTO domainlist (type,domain,enabled,date_added,date_modified,comment)
+    SELECT type,domain,enabled,date_added,date_modified,comment FROM blacklist;
+
+ALTER TABLE regex_whitelist ADD COLUMN type INTEGER;
+UPDATE regex_whitelist SET type = 2;
+INSERT INTO domainlist (type,domain,enabled,date_added,date_modified,comment)
+    SELECT type,domain,enabled,date_added,date_modified,comment FROM regex_whitelist;
+
+ALTER TABLE regex_blacklist ADD COLUMN type INTEGER;
+UPDATE regex_blacklist SET type = 3;
+INSERT INTO domainlist (type,domain,enabled,date_added,date_modified,comment)
+    SELECT type,domain,enabled,date_added,date_modified,comment FROM regex_blacklist;
+
+DROP TABLE whitelist_by_group;
+DROP TABLE blacklist_by_group;
+DROP TABLE regex_whitelist_by_group;
+DROP TABLE regex_blacklist_by_group;
+CREATE TABLE domainlist_by_group
+(
+    domainlist_id INTEGER NOT NULL REFERENCES domainlist (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (domainlist_id, group_id)
+);
+
+DROP TRIGGER tr_whitelist_update;
+DROP TRIGGER tr_blacklist_update;
+DROP TRIGGER tr_regex_whitelist_update;
+DROP TRIGGER tr_regex_blacklist_update;
+CREATE TRIGGER tr_domainlist_update AFTER UPDATE ON domainlist
+    BEGIN
+      UPDATE domainlist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE domain = NEW.domain;
+    END;
+
+DROP VIEW vw_whitelist;
+CREATE VIEW vw_whitelist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 0
+    ORDER BY domainlist.id;
+
+DROP VIEW vw_blacklist;
+CREATE VIEW vw_blacklist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 1
+    ORDER BY domainlist.id;
+
+DROP VIEW vw_regex_whitelist;
+CREATE VIEW vw_regex_whitelist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 2
+    ORDER BY domainlist.id;
+
+DROP VIEW vw_regex_blacklist;
+CREATE VIEW vw_regex_blacklist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 3
+    ORDER BY domainlist.id;
+
+UPDATE info SET value = 4 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/4_to_5.sql

@@ -0,0 +1,38 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP TABLE gravity;
+CREATE TABLE gravity
+(
+    domain TEXT NOT NULL,
+    adlist_id INTEGER NOT NULL REFERENCES adlist (id),
+    PRIMARY KEY(domain, adlist_id)
+);
+
+DROP VIEW vw_gravity;
+CREATE VIEW vw_gravity AS SELECT domain, adlist_by_group.group_id AS group_id
+    FROM gravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = gravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = gravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1);
+
+CREATE TABLE client
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ip TEXT NOL NULL UNIQUE
+);
+
+CREATE TABLE client_by_group
+(
+    client_id INTEGER NOT NULL REFERENCES client (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (client_id, group_id)
+);
+
+UPDATE info SET value = 5 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/5_to_6.sql

@@ -0,0 +1,17 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP VIEW vw_adlist;
+CREATE VIEW vw_adlist AS SELECT DISTINCT address, adlist.id AS id
+    FROM adlist
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = adlist.id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    ORDER BY adlist.id;
+
+UPDATE info SET value = 6 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/6_to_7.sql

@@ -0,0 +1,35 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+INSERT OR REPLACE INTO "group" (id,enabled,name) VALUES (0,1,'Unassociated');
+
+INSERT INTO domainlist_by_group (domainlist_id, group_id) SELECT id, 0 FROM domainlist;
+INSERT INTO client_by_group (client_id, group_id) SELECT id, 0 FROM client;
+INSERT INTO adlist_by_group (adlist_id, group_id) SELECT id, 0 FROM adlist;
+
+CREATE TRIGGER tr_domainlist_add AFTER INSERT ON domainlist
+    BEGIN
+      INSERT INTO domainlist_by_group (domainlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_client_add AFTER INSERT ON client
+    BEGIN
+      INSERT INTO client_by_group (client_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_adlist_add AFTER INSERT ON adlist
+    BEGIN
+      INSERT INTO adlist_by_group (adlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_group_zero AFTER DELETE ON "group"
+    BEGIN
+      INSERT OR REPLACE INTO "group" (id,enabled,name) VALUES (0,1,'Unassociated');
+    END;
+
+UPDATE info SET value = 7 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/7_to_8.sql

@@ -0,0 +1,35 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+ALTER TABLE "group" RENAME TO "group__";
+
+CREATE TABLE "group"
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    name TEXT UNIQUE NOT NULL,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    description TEXT
+);
+
+CREATE TRIGGER tr_group_update AFTER UPDATE ON "group"
+    BEGIN
+      UPDATE "group" SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+INSERT OR IGNORE INTO "group" (id,enabled,name,description) SELECT id,enabled,name,description FROM "group__";
+
+DROP TABLE "group__";
+
+CREATE TRIGGER tr_group_zero AFTER DELETE ON "group"
+    BEGIN
+      INSERT OR IGNORE INTO "group" (id,enabled,name) VALUES (0,1,'Unassociated');
+    END;
+
+UPDATE info SET value = 8 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/8_to_9.sql

@@ -0,0 +1,27 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP TRIGGER IF EXISTS tr_group_update;
+DROP TRIGGER IF EXISTS tr_group_zero;
+
+PRAGMA legacy_alter_table=ON;
+ALTER TABLE "group" RENAME TO "group__";
+PRAGMA legacy_alter_table=OFF;
+ALTER TABLE "group__" RENAME TO "group";
+
+CREATE TRIGGER tr_group_update AFTER UPDATE ON "group"
+    BEGIN
+      UPDATE "group" SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER tr_group_zero AFTER DELETE ON "group"
+    BEGIN
+      INSERT OR IGNORE INTO "group" (id,enabled,name) VALUES (0,1,'Unassociated');
+    END;
+
+UPDATE info SET value = 9 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/database_migration/gravity/9_to_10.sql

@@ -0,0 +1,29 @@
+.timeout 30000
+
+PRAGMA FOREIGN_KEYS=OFF;
+
+BEGIN TRANSACTION;
+
+DROP TABLE IF EXISTS whitelist;
+DROP TABLE IF EXISTS blacklist;
+DROP TABLE IF EXISTS regex_whitelist;
+DROP TABLE IF EXISTS regex_blacklist;
+
+CREATE TRIGGER tr_domainlist_delete AFTER DELETE ON domainlist
+    BEGIN
+      DELETE FROM domainlist_by_group WHERE domainlist_id = OLD.id;
+    END;
+
+CREATE TRIGGER tr_adlist_delete AFTER DELETE ON adlist
+    BEGIN
+      DELETE FROM adlist_by_group WHERE adlist_id = OLD.id;
+    END;
+
+CREATE TRIGGER tr_client_delete AFTER DELETE ON client
+    BEGIN
+      DELETE FROM client_by_group WHERE client_id = OLD.id;
+    END;
+
+UPDATE info SET value = 10 WHERE property = 'version';
+
+COMMIT;

advanced/Scripts/list.sh

@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC1090
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# allowlist and denylist domains
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+readonly PI_HOLE_SCRIPT_DIR="/opt/pihole"
+readonly utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+source "${utilsfile}"
+
+readonly apifile="${PI_HOLE_SCRIPT_DIR}/api.sh"
+source "${apifile}"
+
+# Determine database location
+DBFILE=$(getFTLConfigValue "files.database")
+if [ -z "$DBFILE" ]; then
+    DBFILE="/etc/pihole/pihole-FTL.db"
+fi
+
+# Determine gravity database location
+GRAVITYDB=$(getFTLConfigValue "files.gravity")
+if [ -z "$GRAVITYDB" ]; then
+    GRAVITYDB="/etc/pihole/gravity.db"
+fi
+
+addmode=true
+verbose=true
+wildcard=false
+
+domList=()
+
+typeId=""
+comment=""
+
+colfile="/opt/pihole/COL_TABLE"
+source ${colfile}
+
+helpFunc() {
+    echo "Usage: pihole ${abbrv} [options] <domain> <domain2 ...>
+Example: 'pihole ${abbrv} site.com', or 'pihole ${abbrv} site1.com site2.com'
+${typeId^} one or more ${kindId} domains
+
+Options:
+  remove, delete, -d  Remove domain(s)
+  -q, --quiet         Make output less verbose
+  -h, --help          Show this help dialog
+  -l, --list          Display domains
+  --comment \"text\"    Add a comment to the domain. If adding multiple domains the same comment will be used for all"
+
+  exit 0
+}
+
+CreateDomainList() {
+    # Format domain into regex filter if requested
+    local dom=${1}
+    if [[ "${wildcard}" == true ]]; then
+        dom="(\\.|^)${dom//\./\\.}$"
+    fi
+    domList=("${domList[@]}" "${dom}")
+}
+
+AddDomain() {
+    local json num data
+
+    # Authenticate with the API
+    LoginAPI
+
+    # Prepare request to POST /api/domains/{type}/{kind}
+    # Build JSON object of the following form
+    #  {
+    #    "domain": [ <domains> ],
+    #    "comment": <comment>
+    #  }
+    # where <domains> is an array of domain strings and <comment> is a string
+    # We use jq to build the JSON object
+    json=$(jq --null-input --compact-output --arg domains "${domList[*]}" --arg comment "${comment}" '{domain: $domains | split(" "), comment: $comment}')
+
+    # Send the request
+    data=$(PostFTLData "domains/${typeId}/${kindId}" "${json}")
+
+    # Display domain(s) added
+    # (they are listed in .processed.success, use jq)
+    num=$(echo "${data}" | jq '.processed.success | length')
+    if [[ "${num}" -gt 0 ]] && [[ "${verbose}" == true ]]; then
+        echo -e "  ${TICK} Added ${num} domain(s):"
+        for i in $(seq 0 $((num-1))); do
+            echo -e "    - ${COL_BLUE}$(echo "${data}" | jq --raw-output ".processed.success[$i].item")${COL_NC}"
+        done
+    fi
+    # Display failed domain(s)
+    # (they are listed in .processed.errors, use jq)
+    num=$(echo "${data}" | jq '.processed.errors | length')
+    if [[ "${num}" -gt 0 ]] && [[ "${verbose}" == true ]]; then
+        echo -e "  ${CROSS} Failed to add ${num} domain(s):"
+        for i in $(seq 0 $((num-1))); do
+            echo -e "    - ${COL_BLUE}$(echo "${data}" | jq --raw-output ".processed.errors[$i].item")${COL_NC}"
+            error=$(echo "${data}" | jq --raw-output ".processed.errors[$i].error")
+            if [[ "${error}" == "UNIQUE constraint failed: domainlist.domain, domainlist.type" ]]; then
+                error="Domain already in the specified list"
+            fi
+            echo -e "      ${error}"
+        done
+    fi
+
+    # Log out
+    LogoutAPI
+}
+
+RemoveDomain() {
+    local json num data status
+
+    # Authenticate with the API
+    LoginAPI
+
+    # Prepare request to POST /api/domains:batchDelete
+    # Build JSON object of the following form
+    #  [{
+    #    "item": <domain>,
+    #    "type": "${typeId}",
+    #    "kind": "${kindId}",
+    #  }]
+    # where <domain> is the domain string and ${typeId} and ${kindId} are the type and kind IDs
+    # We use jq to build the JSON object)
+    json=$(jq --null-input --compact-output --arg domains "${domList[*]}" --arg typeId "${typeId}" --arg kindId "${kindId}" '[ $domains | split(" ")[] as $item | {item: $item, type: $typeId, kind: $kindId} ]')
+
+    # Send the request
+    data=$(PostFTLData "domains:batchDelete" "${json}" "status")
+    # Separate the status from the data
+    status=$(printf %s "${data#"${data%???}"}")
+    data=$(printf %s "${data%???}")
+
+    # If there is an .error object in the returned data, display it
+    local error
+    error=$(jq --compact-output <<< "${data}" '.error')
+    if [[ $error != "null" && $error != "" ]]; then
+        echo -e "  ${CROSS} Failed to remove domain(s):"
+        echo -e "      $(jq <<< "${data}" '.error')"
+    elif [[ "${verbose}" == true && "${status}" == "204" ]]; then
+        echo -e "  ${TICK} Domain(s) removed from the ${kindId} ${typeId}list"
+    elif [[ "${verbose}" == true && "${status}" == "404" ]]; then
+        echo -e "  ${TICK} Requested domain(s) not found on ${kindId} ${typeId}list"
+    fi
+
+    # Log out
+    LogoutAPI
+}
+
+Displaylist() {
+    local data
+
+    # if either typeId or kindId is empty, we cannot display the list
+    if [[ -z "${typeId}" ]] || [[ -z "${kindId}" ]]; then
+        echo "  ${CROSS} Unable to display list. Please specify a list type and kind."
+        exit 1
+    fi
+
+    # Authenticate with the API
+    LoginAPI
+
+    # Send the request
+    data=$(GetFTLData "domains/${typeId}/${kindId}")
+
+    # Display the list
+    num=$(echo "${data}" | jq '.domains | length')
+    if [[ "${num}" -gt 0 ]]; then
+        echo -e "  ${TICK} Found ${num} domain(s) in the ${kindId} ${typeId}list:"
+        for i in $(seq 0 $((num-1))); do
+            echo -e "    - ${COL_BLUE}$(echo "${data}" | jq --compact-output ".domains[$i].domain")${COL_NC}"
+            echo -e "      Comment: $(echo "${data}" | jq --compact-output ".domains[$i].comment")"
+            echo -e "      Groups: $(echo "${data}" | jq --compact-output ".domains[$i].groups")"
+            echo -e "      Added: $(date -d @"$(echo "${data}" | jq --compact-output ".domains[$i].date_added")")"
+            echo -e "      Last modified: $(date -d @"$(echo "${data}" | jq --compact-output ".domains[$i].date_modified")")"
+        done
+    else
+        echo -e "  ${INFO} No domains found in the ${kindId} ${typeId}list"
+    fi
+
+    # Log out
+    LogoutAPI
+
+    # Return early without adding/deleting domains
+    exit 0
+}
+
+GetComment() {
+    comment="$1"
+    if [[ "${comment}" =~ [^a-zA-Z0-9_\#:/\.,\ -] ]]; then
+        echo "  ${CROSS} Found invalid characters in domain comment!"
+        exit 1
+    fi
+}
+
+while (( "$#" )); do
+    case "${1}" in
+        "allow" | "allowlist" ) kindId="exact"; typeId="allow"; abbrv="allow";;
+        "deny" | "denylist"   ) kindId="exact"; typeId="deny"; abbrv="deny";;
+        "--allow-regex" | "allow-regex" ) kindId="regex"; typeId="allow"; abbrv="--allow-regex";;
+        "--allow-wild" | "allow-wild" ) kindId="regex"; typeId="allow"; wildcard=true; abbrv="--allow-wild";;
+        "--regex" | "regex"   ) kindId="regex"; typeId="deny"; abbrv="--regex";;
+        "--wild" | "wildcard" ) kindId="regex"; typeId="deny"; wildcard=true; abbrv="--wild";;
+        "-d" | "remove" | "delete" ) addmode=false;;
+        "-q" | "--quiet"     ) verbose=false;;
+        "-h" | "--help"      ) helpFunc;;
+        "-l" | "--list"      ) Displaylist;;
+        "--comment"          ) GetComment "${2}"; shift;;
+        *                    ) CreateDomainList "${1}";;
+    esac
+    shift
+done
+
+shift
+
+if [[ ${#domList[@]} == 0 ]]; then
+    helpFunc
+fi
+
+if ${addmode}; then
+    AddDomain
+else
+    RemoveDomain
+fi

advanced/Scripts/piholeARPTable.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC1090
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2019 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# ARP table interaction
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+coltable="/opt/pihole/COL_TABLE"
+if [[ -f ${coltable} ]]; then
+    source ${coltable}
+fi
+
+readonly PI_HOLE_SCRIPT_DIR="/opt/pihole"
+utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+source "${utilsfile}"
+
+# Determine database location
+DBFILE=$(getFTLConfigValue "files.database")
+if [ -z "$DBFILE" ]; then
+    DBFILE="/etc/pihole/pihole-FTL.db"
+fi
+
+flushARP(){
+    local output
+    if [[ "${args[1]}" != "quiet" ]]; then
+        echo -ne "  ${INFO} Flushing network table ..."
+    fi
+
+    # Stop FTL to prevent database access
+    if ! output=$(service pihole-FTL stop 2>&1); then
+        echo -e "${OVER}  ${CROSS} Failed to stop FTL"
+        echo "  Output: ${output}"
+        return 1
+    fi
+
+    # Truncate network_addresses table in pihole-FTL.db
+    # This needs to be done before we can truncate the network table due to
+    # foreign key constraints
+    if ! output=$(pihole-FTL sqlite3 -ni "${DBFILE}" "DELETE FROM network_addresses" 2>&1); then
+        echo -e "${OVER}  ${CROSS} Failed to truncate network_addresses table"
+        echo "  Database location: ${DBFILE}"
+        echo "  Output: ${output}"
+        return 1
+    fi
+
+    # Truncate network table in pihole-FTL.db
+    if ! output=$(pihole-FTL sqlite3 -ni "${DBFILE}" "DELETE FROM network" 2>&1); then
+        echo -e "${OVER}  ${CROSS} Failed to truncate network table"
+        echo "  Database location: ${DBFILE}"
+        echo "  Output: ${output}"
+        return 1
+    fi
+
+    # Flush ARP cache of the host
+    if ! output=$(ip -s -s neigh flush all 2>&1); then
+        echo -e "${OVER}  ${CROSS} Failed to flush ARP cache"
+        echo "  Output: ${output}"
+        return 1
+    fi
+
+    # Start FTL again
+    if ! output=$(service pihole-FTL restart 2>&1); then
+        echo -e "${OVER}  ${CROSS} Failed to restart FTL"
+        echo "  Output: ${output}"
+        return 1
+    fi
+
+    if [[ "${args[1]}" != "quiet" ]]; then
+        echo -e "${OVER}  ${TICK} Flushed network table"
+    fi
+}
+
+args=("$@")
+
+case "${args[0]}" in
+    "arpflush"            ) flushARP;;
+esac

advanced/Scripts/piholeCheckout.sh

@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Switch Pi-hole subsystems to a different GitHub branch.
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+readonly PI_HOLE_FILES_DIR="/etc/.pihole"
+SKIP_INSTALL="true"
+source "${PI_HOLE_FILES_DIR}/automated install/basic-install.sh"
+
+# webInterfaceGitUrl set in basic-install.sh
+# webInterfaceDir set in basic-install.sh
+# piholeGitURL set in basic-install.sh
+# is_repo() sourced from basic-install.sh
+# check_download_exists sourced from basic-install.sh
+# fully_fetch_repo sourced from basic-install.sh
+# get_available_branches sourced from basic-install.sh
+# fetch_checkout_pull_branch sourced from basic-install.sh
+# checkout_pull_branch sourced from basic-install.sh
+
+warning1() {
+    echo "  Please note that changing branches severely alters your Pi-hole subsystems"
+    echo "  Features that work on the master branch, may not on a development branch"
+    echo -e "  ${COL_LIGHT_RED}This feature is NOT supported unless a Pi-hole developer explicitly asks!${COL_NC}"
+    read -r -p "  Have you read and understood this? [y/N] " response
+    case "${response}" in
+        [yY][eE][sS]|[yY])
+            echo ""
+            return 0
+            ;;
+        *)
+            echo -e "\\n  ${INFO} Branch change has been canceled"
+            return 1
+            ;;
+    esac
+}
+
+checkout() {
+    local corebranches
+    local webbranches
+
+    # Check if FTL is installed - do this early on as FTL is a hard dependency for Pi-hole
+    local funcOutput
+    funcOutput=$(get_binary_name) #Store output of get_binary_name here
+    local binary
+    binary="pihole-FTL${funcOutput##*pihole-FTL}" #binary name will be the last line of the output of get_binary_name (it always begins with pihole-FTL)
+
+    # Avoid globbing
+    set -f
+
+    # This is unlikely
+    if ! is_repo "${PI_HOLE_FILES_DIR}" ; then
+        echo -e "  ${COL_LIGHT_RED}Error: Core Pi-hole repo is missing from system!"
+        echo -e "  Please re-run install script from https://github.com/pi-hole/pi-hole${COL_NC}"
+        exit 1;
+    fi
+
+    if ! is_repo "${webInterfaceDir}" ; then
+        echo -e "  ${COL_LIGHT_RED}Error: Web Admin repo is missing from system!"
+        echo -e "  Please re-run install script from https://github.com/pi-hole/pi-hole${COL_NC}"
+        exit 1;
+    fi
+
+    if [[ -z "${1}" ]]; then
+        echo -e "  ${COL_LIGHT_RED}Invalid option${COL_NC}"
+        echo -e "  Try 'pihole checkout --help' for more information."
+        exit 1
+    fi
+
+    if ! warning1 ; then
+        exit 1
+    fi
+
+    if [[ "${1}" == "dev" ]] ; then
+        # Shortcut to check out development branches
+        echo -e "  ${INFO} Shortcut \"${COL_YELLOW}dev${COL_NC}\" detected - checking out development branches..."
+        echo ""
+        echo -e "  ${INFO} Pi-hole Core"
+        fetch_checkout_pull_branch "${PI_HOLE_FILES_DIR}" "development" || { echo "  ${CROSS} Unable to pull Core development branch"; exit 1; }
+        echo ""
+        echo -e "  ${INFO} Web interface"
+        fetch_checkout_pull_branch "${webInterfaceDir}" "development" || { echo "  ${CROSS} Unable to pull Web development branch"; exit 1; }
+        #echo -e "  ${TICK} Pi-hole Core"
+
+        local path
+        path="development/${binary}"
+        echo "development" > /etc/pihole/ftlbranch
+        chmod 644 /etc/pihole/ftlbranch
+    elif [[ "${1}" == "master" ]] ; then
+        # Shortcut to check out master branches
+        echo -e "  ${INFO} Shortcut \"${COL_YELLOW}master${COL_NC}\" detected - checking out master branches..."
+        echo -e "  ${INFO} Pi-hole core"
+        fetch_checkout_pull_branch "${PI_HOLE_FILES_DIR}" "master" || { echo "  ${CROSS} Unable to pull Core master branch"; exit 1; }
+        echo -e "  ${INFO} Web interface"
+        fetch_checkout_pull_branch "${webInterfaceDir}" "master" || { echo "  ${CROSS} Unable to pull Web master branch"; exit 1; }
+        #echo -e "  ${TICK} Web Interface"
+        local path
+        path="master/${binary}"
+        echo "master" > /etc/pihole/ftlbranch
+        chmod 644 /etc/pihole/ftlbranch
+    elif [[ "${1}" == "core" ]] ; then
+        str="Fetching branches from ${piholeGitUrl}"
+        echo -ne "  ${INFO} $str"
+        if ! fully_fetch_repo "${PI_HOLE_FILES_DIR}" ; then
+            echo -e "${OVER}  ${CROSS} $str"
+            exit 1
+        fi
+        corebranches=($(get_available_branches "${PI_HOLE_FILES_DIR}"))
+
+        if [[ "${corebranches[*]}" == *"master"* ]]; then
+            echo -e "${OVER}  ${TICK} $str"
+            echo -e "  ${INFO} ${#corebranches[@]} branches available for Pi-hole Core"
+        else
+            # Print STDERR output from get_available_branches
+            echo -e "${OVER}  ${CROSS} $str\\n\\n${corebranches[*]}"
+            exit 1
+        fi
+
+        echo ""
+        # Have the user choose the branch they want
+        if ! (for e in "${corebranches[@]}"; do [[ "$e" == "${2}" ]] && exit 0; done); then
+            echo -e "  ${INFO} Requested branch \"${COL_CYAN}${2}${COL_NC}\" is not available"
+            echo -e "  ${INFO} Available branches for Core are:"
+            for e in "${corebranches[@]}"; do echo "      - $e"; done
+            exit 1
+        fi
+        checkout_pull_branch "${PI_HOLE_FILES_DIR}" "${2}"
+    elif [[ "${1}" == "web" ]] ; then
+        str="Fetching branches from ${webInterfaceGitUrl}"
+        echo -ne "  ${INFO} $str"
+        if ! fully_fetch_repo "${webInterfaceDir}" ; then
+            echo -e "${OVER}  ${CROSS} $str"
+            exit 1
+        fi
+        webbranches=($(get_available_branches "${webInterfaceDir}"))
+
+        if [[ "${webbranches[*]}" == *"master"* ]]; then
+            echo -e "${OVER}  ${TICK} $str"
+            echo -e "  ${INFO} ${#webbranches[@]} branches available for Web Admin"
+        else
+            # Print STDERR output from get_available_branches
+            echo -e "${OVER}  ${CROSS} $str\\n\\n${webbranches[*]}"
+            exit 1
+        fi
+
+        echo ""
+        # Have the user choose the branch they want
+        if ! (for e in "${webbranches[@]}"; do [[ "$e" == "${2}" ]] && exit 0; done); then
+            echo -e "  ${INFO} Requested branch \"${COL_CYAN}${2}${COL_NC}\" is not available"
+            echo -e "  ${INFO} Available branches for Web Admin are:"
+            for e in "${webbranches[@]}"; do echo "      - $e"; done
+            exit 1
+        fi
+        checkout_pull_branch "${webInterfaceDir}" "${2}"
+        # Update local and remote versions via updatechecker
+        /opt/pihole/updatecheck.sh
+    elif [[ "${1}" == "ftl" ]] ; then
+        local path
+        local oldbranch
+        local existing=false
+        path="${2}/${binary}"
+        oldbranch="$(pihole-FTL -b)"
+
+        # Check if requested branch is available
+        echo -e "  ${INFO} Checking for availability of branch ${COL_CYAN}${2}${COL_NC} on GitHub"
+        ftlbranches=( $(git ls-remote https://github.com/pi-hole/ftl | grep "refs/heads" | cut -d'/' -f3- -) )
+        # If returned array is empty -> connectivity issue
+        if [[ ${#ftlbranches[@]} -eq 0 ]]; then
+            echo -e "  ${CROSS} Unable to fetch branches from GitHub. Please check your Internet connection and try again later."
+            exit 1
+        fi
+
+        for e in "${ftlbranches[@]}"; do [[ "$e" == "${2}" ]] && existing=true; done
+        if [[ "${existing}" == false ]]; then
+            echo -e "  ${CROSS} Requested branch is not available\n"
+            echo -e "  ${INFO} Available branches are:"
+            for e in "${ftlbranches[@]}"; do echo "      - $e"; done
+            exit 1
+        fi
+        echo -e "  ${TICK} Branch ${2} exists on GitHub"
+
+        echo -e "  ${INFO} Checking for ${COL_YELLOW}${binary}${COL_NC} binary on https://ftl.pi-hole.net"
+
+        if check_download_exists "$path"; then
+            echo "  ${TICK} Binary exists"
+            echo "${2}" > /etc/pihole/ftlbranch
+            chmod 644 /etc/pihole/ftlbranch
+            echo -e "  ${INFO} Switching to branch: ${COL_CYAN}${2}${COL_NC} from ${COL_CYAN}${oldbranch}${COL_NC}"
+            FTLinstall "${binary}"
+            restart_service pihole-FTL
+            enable_service pihole-FTL
+            str="Restarting FTL..."
+            echo -ne "  ${INFO} ${str}"
+            # Wait until name resolution is working again after restarting FTL,
+            # so that the updatechecker can run successfully and does not fail
+            # trying to resolve github.com
+            until getent hosts github.com &> /dev/null; do
+                # Append one dot for each second waiting
+                str="${str}."
+                echo -ne "  ${OVER}  ${INFO} ${str}"
+                sleep 1
+            done
+            echo -e "  ${OVER}  ${TICK} Restarted FTL service"
+
+            # Update local and remote versions via updatechecker
+            /opt/pihole/updatecheck.sh
+        else
+            if [ $? -eq 1 ]; then
+                # Binary for requested branch is not available, may still be
+                # int he process of being built or CI build job failed
+                printf "  %b Binary for requested branch is not available, please try again later.\\n" ${CROSS}
+                printf "      If the issue persists, please contact Pi-hole Support and ask them to re-generate the binary.\\n"
+                exit 1
+            elif [ $? -eq 2 ]; then
+                printf "  %b Unable to download from ftl.pi-hole.net. Please check your Internet connection and try again later.\\n" "${CROSS}"
+                exit 1
+            else
+                printf "  %b Unknown checkout error. Please contact Pi-hole Support\\n" "${CROSS}"
+                exit 1
+            fi
+        fi
+
+    else
+        echo -e "  ${CROSS} Requested option \"${1}\" is not available"
+        exit 1
+    fi
+
+    # Force updating everything
+    if [[  ! "${1}" == "web" && ! "${1}" == "ftl" ]]; then
+        echo -e "  ${INFO} Running installer to upgrade your installation"
+        if "${PI_HOLE_FILES_DIR}/automated install/basic-install.sh" --unattended; then
+            exit 0
+        else
+            echo -e "  ${COL_LIGHT_RED} Error: Unable to complete update, please contact support${COL_NC}"
+            exit 1
+        fi
+    fi
+}

advanced/Scripts/piholeLogFlush.sh

@@ -1,11 +1,122 @@
 #!/usr/bin/env bash
-# Flushes /var/log/pihole.log
+# Pi-hole: A black hole for Internet advertisements
-# (c) 2015 by Jacob Salmela
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
-# This file is part of Pi-hole.
+# Network-wide ad blocking via your own hardware.
 #
-#Pi-hole is free software: you can redistribute it and/or modify
+# Flushes Pi-hole's log file
-#it under the terms of the GNU General Public License as published by
+#
-#the Free Software Foundation, either version 2 of the License, or
+# This file is copyright under the latest version of the EUPL.
-#(at your option) any later version.
+# Please see LICENSE file for your rights under this license.
+
+colfile="/opt/pihole/COL_TABLE"
+source ${colfile}
+
+readonly PI_HOLE_SCRIPT_DIR="/opt/pihole"
+utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+source "${utilsfile}"
+
+# In case we're running at the same time as a system logrotate, use a
+# separate logrotate state file to prevent stepping on each other's
+# toes.
+STATEFILE="/var/lib/logrotate/pihole"
+
+# Determine database location
+DBFILE=$(getFTLConfigValue "files.database")
+if [ -z "$DBFILE" ]; then
+    DBFILE="/etc/pihole/pihole-FTL.db"
+fi
+
+# Determine log file location
+LOGFILE=$(getFTLConfigValue "files.log.dnsmasq")
+if [ -z "$LOGFILE" ]; then
+    LOGFILE="/var/log/pihole/pihole.log"
+fi
+FTLFILE=$(getFTLConfigValue "files.log.ftl")
+if [ -z "$FTLFILE" ]; then
+    FTLFILE="/var/log/pihole/FTL.log"
+fi
+
+if [[ "$*" == *"once"* ]]; then
+    # Nightly logrotation
+    if command -v /usr/sbin/logrotate >/dev/null; then
+        # Logrotate once
+
+        if [[ "$*" != *"quiet"* ]]; then
+            echo -ne "  ${INFO} Running logrotate ..."
+        fi
+        /usr/sbin/logrotate --force --state "${STATEFILE}" /etc/pihole/logrotate
+    else
+        # Copy pihole.log over to pihole.log.1
+        # and empty out pihole.log
+        # Note that moving the file is not an option, as
+        # dnsmasq would happily continue writing into the
+        # moved file (it will have the same file handler)
+        if [[ "$*" != *"quiet"* ]]; then
+            echo -ne "  ${INFO} Rotating ${LOGFILE} ..."
+        fi
+        cp -p "${LOGFILE}" "${LOGFILE}.1"
+        echo " " > "${LOGFILE}"
+        chmod 640 "${LOGFILE}"
+        if [[ "$*" != *"quiet"* ]]; then
+            echo -e "${OVER}  ${TICK} Rotated ${LOGFILE} ..."
+        fi
+        # Copy FTL.log over to FTL.log.1
+        # and empty out FTL.log
+        if [[ "$*" != *"quiet"* ]]; then
+            echo -ne "  ${INFO} Rotating ${FTLFILE} ..."
+        fi
+        cp -p "${FTLFILE}" "${FTLFILE}.1"
+        echo " " > "${FTLFILE}"
+        chmod 640 "${FTLFILE}"
+        if [[ "$*" != *"quiet"* ]]; then
+            echo -e "${OVER}  ${TICK} Rotated ${FTLFILE} ..."
+        fi
+    fi
+else
+    # Manual flushing
+
+    # Flush both pihole.log and pihole.log.1 (if existing)
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -ne "  ${INFO} Flushing ${LOGFILE} ..."
+    fi
+    echo " " > "${LOGFILE}"
+    chmod 640 "${LOGFILE}"
+    if [ -f "${LOGFILE}.1" ]; then
+        echo " " > "${LOGFILE}.1"
+        chmod 640 "${LOGFILE}.1"
+    fi
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -e "${OVER}  ${TICK} Flushed ${LOGFILE} ..."
+    fi
+
+    # Flush both FTL.log and FTL.log.1 (if existing)
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -ne "  ${INFO} Flushing ${FTLFILE} ..."
+    fi
+    echo " " > "${FTLFILE}"
+    chmod 640 "${FTLFILE}"
+    if [ -f "${FTLFILE}.1" ]; then
+        echo " " > "${FTLFILE}.1"
+        chmod 640 "${FTLFILE}.1"
+    fi
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -e "${OVER}  ${TICK} Flushed ${FTLFILE} ..."
+    fi
+
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -ne "  ${INFO} Flushing database, DNS resolution temporarily unavailable ..."
+    fi
+
+    # Stop FTL to make sure it doesn't write to the database while we're deleting data
+    service pihole-FTL stop
+
+    # Delete most recent 24 hours from FTL's database, leave even older data intact (don't wipe out all history)
+    deleted=$(pihole-FTL sqlite3 -ni "${DBFILE}" "DELETE FROM query_storage WHERE timestamp >= strftime('%s','now')-86400; select changes() from query_storage limit 1")
+
+    # Restart FTL
+    service pihole-FTL restart
+    if [[ "$*" != *"quiet"* ]]; then
+        echo -e "${OVER}  ${TICK} Deleted ${deleted} queries from long-term query database"
+    fi
+fi
 
-truncate -s 0 /var/log/pihole.log

advanced/Scripts/query.sh

@@ -0,0 +1,157 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC1090
+
+# Ignore warning about `local` being undefinded in POSIX
+# shellcheck disable=SC3043
+# https://github.com/koalaman/shellcheck/wiki/SC3043#exceptions
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2023 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Search Adlists
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+# Globals
+PI_HOLE_INSTALL_DIR="/opt/pihole"
+max_results="20"
+partial="false"
+domain=""
+
+# Source color table
+colfile="/opt/pihole/COL_TABLE"
+. "${colfile}"
+
+# Source api functions
+. "${PI_HOLE_INSTALL_DIR}/api.sh"
+
+Help() {
+    echo "Usage: pihole -q [option] <domain>
+Example: 'pihole -q --partial domain.com'
+Query the adlists for a specified domain
+
+Options:
+  --partial            Search the adlists for partially matching domains
+  --all                Return all query matches within the adlists
+  -h, --help           Show this help dialog"
+    exit 0
+}
+
+GenerateOutput() {
+    local data gravity_data lists_data num_gravity num_lists search_type_str
+    local gravity_data_csv lists_data_csv line current_domain url type color
+    data="${1}"
+
+    # construct a new json for the list results where each object contains the domain and the related type
+    lists_data=$(printf %s "${data}" | jq '.search.domains | [.[] | {domain: .domain, type: .type}]')
+
+    # construct a new json for the gravity results where each object contains the adlist URL and the related domains
+    gravity_data=$(printf %s "${data}" | jq '.search.gravity  | group_by(.address,.type) | map({ address: (.[0].address), type: (.[0].type), domains: [.[] | .domain] })')
+
+    # number of objects in each json
+    num_gravity=$(printf %s "${gravity_data}" | jq length)
+    num_lists=$(printf %s "${lists_data}" | jq length)
+
+    if [ "${partial}" = true ]; then
+        search_type_str="partially"
+    else
+        search_type_str="exactly"
+    fi
+
+    # Results from allow/deny list
+    printf "%s\n\n" "Found ${num_lists} domains ${search_type_str} matching '${COL_BLUE}${domain}${COL_NC}'."
+    if [ "${num_lists}" -gt 0 ]; then
+        # Convert the data to a csv, each line is a "domain,type" string
+        # not using jq's @csv here as it quotes each value individually
+        lists_data_csv=$(printf %s "${lists_data}" | jq --raw-output '.[] | [.domain, .type] | join(",")')
+
+        # Generate output for each csv line, separating line in a domain and type substring at the ','
+        echo "${lists_data_csv}" | while read -r line; do
+            printf "%s\n\n" "  - ${COL_GREEN}${line%,*}${COL_NC} (type: exact ${line#*,} domain)"
+        done
+    fi
+
+    # Results from gravity
+    printf "%s\n\n" "Found ${num_gravity} adlists ${search_type_str} matching '${COL_BLUE}${domain}${COL_NC}'."
+    if [ "${num_gravity}" -gt 0 ]; then
+        # Convert the data to a csv, each line is a "URL,domain,domain,...." string
+        # not using jq's @csv here as it quotes each value individually
+        gravity_data_csv=$(printf %s "${gravity_data}" | jq --raw-output '.[] | [.address, .type, .domains[]] | join(",")')
+
+        # Generate line-by-line output for each csv line
+        echo "${gravity_data_csv}" | while read -r line; do
+            # Get first part of the line, the URL
+            url=${line%%,*}
+
+            # cut off URL, leaving "type,domain,domain,...."
+            line=${line#*,}
+            type=${line%%,*}
+            # type == "block" -> red, type == "allow" -> green
+            if [ "${type}" = "block" ]; then
+                color="${COL_RED}"
+            else
+                color="${COL_GREEN}"
+            fi
+
+            # print adlist URL
+            printf "%s (%s)\n\n" "  - ${COL_BLUE}${url}${COL_NC}" "${color}${type}${COL_NC}"
+
+            # cut off type, leaving "domain,domain,...."
+            line=${line#*,}
+            # print each domain and remove it from the string until nothing is left
+            while [ ${#line} -gt 0 ]; do
+                current_domain=${line%%,*}
+                printf '    - %s\n' "${COL_GREEN}${current_domain}${COL_NC}"
+                # we need to remove the current_domain and the comma in two steps because
+                # the last domain won't have a trailing comma and the while loop wouldn't exit
+                line=${line#"${current_domain}"}
+                line=${line#,}
+            done
+            printf "\n\n"
+        done
+    fi
+
+    # If no exact results were found, suggest using partial matching
+    if [ "${num_lists}" -eq 0 ] && [ "${num_gravity}" -eq 0 ] && [ "${partial}" = false ]; then
+        printf "%s\n" "Hint: Try partial matching with"
+        printf "%s\n\n" "  ${COL_GREEN}pihole -q --partial ${domain}${COL_NC}"
+    fi
+}
+
+Main() {
+    local data
+
+    if [ -z "${domain}" ]; then
+        echo "No domain specified"
+        exit 1
+    fi
+    # domains are lowercased and converted to punycode by FTL since
+    # https://github.com/pi-hole/FTL/pull/1715
+    # no need to do it here
+
+    # Authenticate with FTL
+    LoginAPI
+
+    # send query again
+    data=$(GetFTLData "search/${domain}?N=${max_results}&partial=${partial}")
+
+    GenerateOutput "${data}"
+
+    # Delete session
+    LogoutAPI
+}
+
+# Process all options (if present)
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+    "-h" | "--help") Help ;;
+    "--partial") partial="true" ;;
+    "--all") max_results=10000 ;; # hard-coded FTL limit
+    *) domain=$1 ;;
+    esac
+    shift
+done
+
+Main "${domain}"

advanced/Scripts/update.sh

@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Check Pi-hole core and admin pages versions and determine what
+# upgrade (if any) is required. Automatically updates and reinstalls
+# application if update is detected.
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+# Variables
+readonly ADMIN_INTERFACE_GIT_URL="https://github.com/pi-hole/web.git"
+readonly ADMIN_INTERFACE_DIR="/var/www/html/admin"
+readonly PI_HOLE_GIT_URL="https://github.com/pi-hole/pi-hole.git"
+readonly PI_HOLE_FILES_DIR="/etc/.pihole"
+
+# shellcheck disable=SC2034
+SKIP_INSTALL=true
+
+# when --check-only is passed to this script, it will not perform the actual update
+CHECK_ONLY=false
+
+# shellcheck disable=SC1090
+source "${PI_HOLE_FILES_DIR}/automated install/basic-install.sh"
+# shellcheck disable=SC1091
+source "/opt/pihole/COL_TABLE"
+
+# is_repo() sourced from basic-install.sh
+# make_repo() sourced from basic-install.sh
+# update_repo() source from basic-install.sh
+# getGitFiles() sourced from basic-install.sh
+# FTLcheckUpdate() sourced from basic-install.sh
+
+GitCheckUpdateAvail() {
+    local directory
+    local curBranch
+    directory="${1}"
+    curdir=$PWD
+    cd "${directory}" || exit 1
+
+    # Fetch latest changes in this repo
+    if ! git fetch --quiet origin ; then
+        echo -e "\\n  ${COL_LIGHT_RED}Error: Unable to update local repository. Contact Pi-hole Support.${COL_NC}"
+        exit 1
+    fi
+
+    # Check current branch. If it is master, then check for the latest available tag instead of latest commit.
+    curBranch=$(git rev-parse --abbrev-ref HEAD)
+    if [[ "${curBranch}" == "master" ]]; then
+        # get the latest local tag
+        LOCAL=$(git describe --abbrev=0 --tags master)
+        # get the latest tag from remote
+        REMOTE=$(git describe --abbrev=0 --tags origin/master)
+
+    else
+        # @ alone is a shortcut for HEAD. Older versions of git
+        # need @{0}
+        LOCAL="$(git rev-parse "@{0}")"
+
+        # The suffix @{upstream} to a branchname
+        # (short form <branchname>@{u}) refers
+        # to the branch that the branch specified
+        # by branchname is set to build on top of#
+        # (configured with branch.<name>.remote and
+        # branch.<name>.merge). A missing branchname
+        # defaults to the current one.
+        REMOTE="$(git rev-parse "@{upstream}")"
+    fi
+
+
+    if [[ "${#LOCAL}" == 0 ]]; then
+        echo -e "\\n  ${COL_LIGHT_RED}Error: Local revision could not be obtained, please contact Pi-hole Support"
+        echo -e "  Additional debugging output:${COL_NC}"
+        git status
+        exit 1
+    fi
+    if [[ "${#REMOTE}" == 0 ]]; then
+        echo -e "\\n  ${COL_LIGHT_RED}Error: Remote revision could not be obtained, please contact Pi-hole Support"
+        echo -e "  Additional debugging output:${COL_NC}"
+        git status
+        exit 1
+    fi
+
+    # Change back to original directory
+    cd "${curdir}" || exit 1
+
+    if [[ "${LOCAL}" != "${REMOTE}" ]]; then
+        # Local branch is behind remote branch -> Update
+        return 0
+    else
+        # Local branch is up-to-date or in a situation
+        # where this updater cannot be used (like on a
+        # branch that exists only locally)
+        return 1
+    fi
+}
+
+main() {
+    local basicError="\\n  ${COL_LIGHT_RED}Unable to complete update, please contact Pi-hole Support${COL_NC}"
+    local core_update
+    local web_update
+    local FTL_update
+
+    core_update=false
+    web_update=false
+    FTL_update=false
+
+    # Install packages used by this installation script (necessary if users have removed e.g. git from their systems)
+    package_manager_detect
+    build_dependency_package
+    install_dependent_packages
+
+    # This is unlikely
+    if ! is_repo "${PI_HOLE_FILES_DIR}" ; then
+        echo -e "\\n  ${COL_LIGHT_RED}Error: Core Pi-hole repo is missing from system!"
+        echo -e "  Please re-run install script from https://pi-hole.net${COL_NC}"
+        exit 1;
+    fi
+
+    echo -e "  ${INFO} Checking for updates..."
+
+    if GitCheckUpdateAvail "${PI_HOLE_FILES_DIR}" ; then
+        core_update=true
+        echo -e "  ${INFO} Pi-hole Core:\\t${COL_YELLOW}update available${COL_NC}"
+    else
+        core_update=false
+        echo -e "  ${INFO} Pi-hole Core:\\t${COL_LIGHT_GREEN}up to date${COL_NC}"
+    fi
+
+    if ! is_repo "${ADMIN_INTERFACE_DIR}" ; then
+        echo -e "\\n  ${COL_LIGHT_RED}Error: Web Admin repo is missing from system!"
+        echo -e "  Please re-run install script from https://pi-hole.net${COL_NC}"
+        exit 1;
+    fi
+
+    if GitCheckUpdateAvail "${ADMIN_INTERFACE_DIR}" ; then
+        web_update=true
+        echo -e "  ${INFO} Web Interface:\\t${COL_YELLOW}update available${COL_NC}"
+    else
+        web_update=false
+        echo -e "  ${INFO} Web Interface:\\t${COL_LIGHT_GREEN}up to date${COL_NC}"
+    fi
+
+    local funcOutput
+    funcOutput=$(get_binary_name) #Store output of get_binary_name here
+    local binary
+    binary="pihole-FTL${funcOutput##*pihole-FTL}" #binary name will be the last line of the output of get_binary_name (it always begins with pihole-FTL)
+
+    if FTLcheckUpdate "${binary}" &>/dev/null; then
+        FTL_update=true
+        echo -e "  ${INFO} FTL:\\t\\t${COL_YELLOW}update available${COL_NC}"
+    else
+        case $? in
+            1)
+                echo -e "  ${INFO} FTL:\\t\\t${COL_LIGHT_GREEN}up to date${COL_NC}"
+                ;;
+            2)
+                echo -e "  ${INFO} FTL:\\t\\t${COL_LIGHT_RED}Branch is not available.${COL_NC}\\n\\t\\t\\tUse ${COL_LIGHT_GREEN}pihole checkout ftl [branchname]${COL_NC} to switch to a valid branch."
+                ;;
+            3)
+                echo -e "  ${INFO} FTL:\\t\\t${COL_LIGHT_RED}Something has gone wrong, cannot reach download server${COL_NC}"
+                exit 1
+                ;;
+            *)
+                echo -e "  ${INFO} FTL:\\t\\t${COL_LIGHT_RED}Something has gone wrong, contact support${COL_NC}"
+                exit 1
+        esac
+        FTL_update=false
+    fi
+
+    # Determine FTL branch
+    local ftlBranch
+    if [[ -f "/etc/pihole/ftlbranch" ]]; then
+        ftlBranch=$(</etc/pihole/ftlbranch)
+    else
+        ftlBranch="master"
+    fi
+
+    if [[ ! "${ftlBranch}" == "master" && ! "${ftlBranch}" == "development" ]]; then
+        # Notify user that they are on a custom branch which might mean they they are lost
+        # behind if a branch was merged to development and got abandoned
+        printf "  %b %bWarning:%b You are using FTL from a custom branch (%s) and might be missing future releases.\\n" "${INFO}" "${COL_LIGHT_RED}" "${COL_NC}" "${ftlBranch}"
+    fi
+
+    if [[ "${core_update}" == false && "${web_update}" == false && "${FTL_update}" == false ]]; then
+        echo ""
+        echo -e "  ${TICK} Everything is up to date!"
+        exit 0
+    fi
+
+    if [[ "${CHECK_ONLY}" == true ]]; then
+        echo ""
+        exit 0
+    fi
+
+    if [[ "${core_update}" == true ]]; then
+        echo ""
+        echo -e "  ${INFO} Pi-hole core files out of date, updating local repo."
+        getGitFiles "${PI_HOLE_FILES_DIR}" "${PI_HOLE_GIT_URL}"
+        echo -e "  ${INFO} If you had made any changes in '/etc/.pihole/', they have been stashed using 'git stash'"
+    fi
+
+    if [[ "${web_update}" == true ]]; then
+        echo ""
+        echo -e "  ${INFO} Pi-hole Web Admin files out of date, updating local repo."
+        getGitFiles "${ADMIN_INTERFACE_DIR}" "${ADMIN_INTERFACE_GIT_URL}"
+        echo -e "  ${INFO} If you had made any changes in '/var/www/html/admin/', they have been stashed using 'git stash'"
+    fi
+
+    if [[ "${FTL_update}" == true ]]; then
+        echo ""
+        echo -e "  ${INFO} FTL out of date, it will be updated by the installer."
+    fi
+
+    if [[ "${FTL_update}" == true || "${core_update}" == true ]]; then
+        ${PI_HOLE_FILES_DIR}/automated\ install/basic-install.sh --reconfigure --unattended || \
+            echo -e "${basicError}" && exit 1
+    fi
+
+    if [[ "${FTL_update}" == true || "${core_update}" == true || "${web_update}" == true ]]; then
+        # Update local and remote versions via updatechecker
+        /opt/pihole/updatecheck.sh
+        echo -e "  ${INFO} Local version file information updated."
+    fi
+
+    # if there was only a web update, show the new versions
+    # (on core and FTL updates, this is done as part of the installer run)
+    if [[ "${web_update}" == true &&  "${FTL_update}" == false && "${core_update}" == false ]]; then
+        "${PI_HOLE_BIN_DIR}"/pihole version
+    fi
+
+    echo ""
+    exit 0
+}
+
+if [[ "$1" == "--check-only" ]]; then
+    CHECK_ONLY=true
+fi
+
+main

advanced/Scripts/updateDashboard.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-#
-# this script will update the pihole web interface files.
-#
-# if this is the first time running this script after an 
-# existing installation, the existing web interface files
-# will be removed and replaced with the latest master
-# branch from github. subsequent executions of this script
-# will pull the latest version of the web interface.
-#
-# @TODO: add git as requirement to basic-install.sh
-#
-
-WEB_INTERFACE_GIT_URL="https://github.com/pi-hole/AdminLTE.git"
-WEB_INTERFACE_DIR="/var/www/html/admin"
-
-main() {
-    prerequisites
-    if ! is_repo; then
-        make_repo
-    fi
-    update_repo
-}
-
-prerequisites() {
-
-    # must be root to update
-    if [[ $EUID -ne 0 ]]; then
-        sudo bash "$0" "$@"
-        exit $?
-    fi
-
-    # web interface must already exist. this is a (lazy)
-    # check to make sure pihole is actually installed.
-    if [ ! -d "$WEB_INTERFACE_DIR" ]; then
-        echo "$WEB_INTERFACE_DIR not found. Exiting."
-        exit 1
-    fi
-
-    if ! type "git" > /dev/null; then
-        apt-get -y install git
-    fi
-}
-
-is_repo() {
-    # if the web interface directory does not have a .git folder
-    # it means its using the master.zip archive from the install
-    # script.
-    if [ ! -d "$WEB_INTERFACE_DIR/.git" ]; then
-        return 1
-    fi
-    return 0
-}
-
-# removes the web interface installed from the master.zip archive and
-# replaces it with the current master branch from github
-make_repo() {
-    # remove the non-repod interface and clone the interface
-    rm -rf $WEB_INTERFACE_DIR
-    git clone "$WEB_INTERFACE_GIT_URL" "$WEB_INTERFACE_DIR"
-}
-
-# pulls the latest master branch from github
-update_repo() {
-    # pull the latest commits
-    cd "$WEB_INTERFACE_DIR"
-    git pull    
-}
-
-main

advanced/Scripts/updatecheck.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Checks for local or remote versions and branches
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+function get_local_branch() {
+    # Return active branch
+    cd "${1}" 2>/dev/null || return 1
+    git rev-parse --abbrev-ref HEAD || return 1
+}
+
+function get_local_version() {
+    # Return active version
+    cd "${1}" 2>/dev/null || return 1
+    git describe --tags --always 2>/dev/null || return 1
+}
+
+function get_local_hash() {
+    cd "${1}" 2>/dev/null || return 1
+    git rev-parse --short=8 HEAD || return 1
+}
+
+function get_remote_version() {
+    # if ${2} is = "master" we need to use the "latest" endpoint, otherwise, we simply return null
+    if [[ "${2}" == "master" ]]; then
+        curl -s "https://api.github.com/repos/pi-hole/${1}/releases/latest" 2>/dev/null | jq --raw-output .tag_name || return 1
+    else
+        echo "null"
+    fi
+}
+
+function get_remote_hash() {
+    git ls-remote "https://github.com/pi-hole/${1}" --tags "${2}" | awk '{print substr($0, 1,8);}' || return 1
+}
+
+# Source the utils file for addOrEditKeyValPair()
+# shellcheck disable=SC1091
+. /opt/pihole/utils.sh
+
+# Remove the below three legacy files if they exist
+rm -f "/etc/pihole/GitHubVersions"
+rm -f "/etc/pihole/localbranches"
+rm -f "/etc/pihole/localversions"
+
+# Create new versions file if it does not exist
+VERSION_FILE="/etc/pihole/versions"
+touch "${VERSION_FILE}"
+chmod 644 "${VERSION_FILE}"
+
+# if /pihole.docker.tag file exists, we will use it's value later in this script
+DOCKER_TAG=$(cat /pihole.docker.tag 2>/dev/null)
+release_regex='^([0-9]+\.){1,2}(\*|[0-9]+)(-.*)?$'
+regex=$release_regex'|(^nightly$)|(^dev.*$)'
+if [[ ! "${DOCKER_TAG}" =~ $regex ]]; then
+    # DOCKER_TAG does not match the pattern (see https://regex101.com/r/RsENuz/1), so unset it.
+    unset DOCKER_TAG
+fi
+
+# used in cronjob
+if [[ "$1" == "reboot" ]]; then
+    sleep 30
+fi
+
+# get Core versions
+
+CORE_VERSION="$(get_local_version /etc/.pihole)"
+addOrEditKeyValPair "${VERSION_FILE}" "CORE_VERSION" "${CORE_VERSION}"
+
+CORE_BRANCH="$(get_local_branch /etc/.pihole)"
+addOrEditKeyValPair "${VERSION_FILE}" "CORE_BRANCH" "${CORE_BRANCH}"
+
+CORE_HASH="$(get_local_hash /etc/.pihole)"
+addOrEditKeyValPair "${VERSION_FILE}" "CORE_HASH" "${CORE_HASH}"
+
+GITHUB_CORE_VERSION="$(get_remote_version pi-hole "${CORE_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_VERSION" "${GITHUB_CORE_VERSION}"
+
+GITHUB_CORE_HASH="$(get_remote_hash pi-hole "${CORE_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_HASH" "${GITHUB_CORE_HASH}"
+
+# get Web versions
+
+WEB_VERSION="$(get_local_version /var/www/html/admin)"
+addOrEditKeyValPair "${VERSION_FILE}" "WEB_VERSION" "${WEB_VERSION}"
+
+WEB_BRANCH="$(get_local_branch /var/www/html/admin)"
+addOrEditKeyValPair "${VERSION_FILE}" "WEB_BRANCH" "${WEB_BRANCH}"
+
+WEB_HASH="$(get_local_hash /var/www/html/admin)"
+addOrEditKeyValPair "${VERSION_FILE}" "WEB_HASH" "${WEB_HASH}"
+
+GITHUB_WEB_VERSION="$(get_remote_version web "${WEB_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_VERSION" "${GITHUB_WEB_VERSION}"
+
+GITHUB_WEB_HASH="$(get_remote_hash web "${WEB_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_HASH" "${GITHUB_WEB_HASH}"
+
+# get FTL versions
+
+FTL_VERSION="$(pihole-FTL version)"
+addOrEditKeyValPair "${VERSION_FILE}" "FTL_VERSION" "${FTL_VERSION}"
+
+FTL_BRANCH="$(pihole-FTL branch)"
+addOrEditKeyValPair "${VERSION_FILE}" "FTL_BRANCH" "${FTL_BRANCH}"
+
+FTL_HASH="$(pihole-FTL --hash)"
+addOrEditKeyValPair "${VERSION_FILE}" "FTL_HASH" "${FTL_HASH}"
+
+GITHUB_FTL_VERSION="$(get_remote_version FTL "${FTL_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_VERSION" "${GITHUB_FTL_VERSION}"
+
+GITHUB_FTL_HASH="$(get_remote_hash FTL "${FTL_BRANCH}")"
+addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_HASH" "${GITHUB_FTL_HASH}"
+
+# get Docker versions
+
+if [[ "${DOCKER_TAG}" ]]; then
+    addOrEditKeyValPair "${VERSION_FILE}" "DOCKER_VERSION" "${DOCKER_TAG}"
+
+    # Remote version check only if the tag is a valid release version
+    docker_branch=""
+    if [[ "${DOCKER_TAG}" =~ $release_regex ]]; then
+        docker_branch="master"
+    fi
+
+    GITHUB_DOCKER_VERSION="$(get_remote_version docker-pi-hole "${docker_branch}")"
+    addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_DOCKER_VERSION" "${GITHUB_DOCKER_VERSION}"
+fi

advanced/Scripts/utils.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC3043 #https://github.com/koalaman/shellcheck/wiki/SC3043#exceptions
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Script to hold utility functions for use in other scripts
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+# Basic Housekeeping rules
+#  - Functions must be self contained
+#  - Functions should be grouped with other similar functions
+#  - Functions must be documented
+#  - New functions must have a test added for them in test/test_any_utils.py
+
+#######################
+# Takes Three arguments: file, key, and value.
+#
+# Checks the target file for the existence of the key
+#   - If it exists, it changes the value
+#   - If it does not exist, it adds the value
+#
+# Example usage:
+# addOrEditKeyValPair "/etc/pihole/setupVars.conf" "BLOCKING_ENABLED" "true"
+#######################
+addOrEditKeyValPair() {
+  local file="${1}"
+  local key="${2}"
+  local value="${3}"
+
+  # touch file to prevent grep error if file does not exist yet
+  touch "${file}"
+
+  if grep -q "^${key}=" "${file}"; then
+    # Key already exists in file, modify the value
+    sed -i "/^${key}=/c\\${key}=${value}" "${file}"
+  else
+    # Key does not already exist, add it and it's value
+    echo "${key}=${value}" >> "${file}"
+  fi
+}
+
+#######################
+# returns FTL's PID based on the content of the pihole-FTL.pid file
+#
+# Takes one argument: path to pihole-FTL.pid
+# Example getFTLPID "/run/pihole-FTL.pid"
+#######################
+getFTLPID() {
+    local FTL_PID_FILE="${1}"
+    local FTL_PID
+
+    if [ -s "${FTL_PID_FILE}" ]; then
+        # -s: FILE exists and has a size greater than zero
+        FTL_PID="$(cat "${FTL_PID_FILE}")"
+        # Exploit prevention: unset the variable if there is malicious content
+        # Verify that the value read from the file is numeric
+        expr "${FTL_PID}" : "[^[:digit:]]" > /dev/null && unset FTL_PID
+    fi
+
+    # If FTL is not running, or the PID file contains malicious stuff, substitute
+    # negative PID to signal this
+    FTL_PID=${FTL_PID:=-1}
+    echo  "${FTL_PID}"
+}
+
+#######################
+# returns value from FTLs config file using pihole-FTL --config
+#
+# Takes one argument: key
+# Example getFTLConfigValue dns.piholePTR
+#######################
+getFTLConfigValue(){
+  pihole-FTL --config -q "${1}"
+}
+
+#######################
+# sets value in FTLs config file using pihole-FTL --config
+#
+# Takes two arguments: key and value
+# Example setFTLConfigValue dns.piholePTR PI.HOLE
+#
+# Note, for complex values such as dns.upstreams, you should wrap the value in single quotes:
+# setFTLConfigValue dns.upstreams '[ "8.8.8.8" , "8.8.4.4" ]'
+#######################
+setFTLConfigValue(){
+  pihole-FTL --config "${1}" "${2}" >/dev/null
+  if [[ $? -eq 5 ]]; then
+    echo -e "  ${CROSS} ${1} set by environment variable. Please unset it to use this function"
+    exit 5
+  fi
+}

advanced/Scripts/version.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Show version numbers
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+# Ignore warning about `local` being undefinded in POSIX
+# shellcheck disable=SC3043
+# https://github.com/koalaman/shellcheck/wiki/SC3043#exceptions
+
+# Source the versions file poupulated by updatechecker.sh
+cachedVersions="/etc/pihole/versions"
+
+if [ -f ${cachedVersions} ]; then
+    # shellcheck disable=SC1090
+    . "$cachedVersions"
+else
+    echo "Could not find /etc/pihole/versions. Running update now."
+    pihole updatechecker
+    # shellcheck disable=SC1090
+    . "$cachedVersions"
+fi
+
+main() {
+    local details
+    details=false
+
+    # Automatically show detailed information if
+    # at least one of the components is not on master branch
+    if [ ! "${CORE_BRANCH}" = "master" ] || [ ! "${WEB_BRANCH}" = "master" ] || [ ! "${FTL_BRANCH}" = "master" ]; then
+        details=true
+    fi
+
+    if [ "${details}" = true ]; then
+        echo "Core"
+        echo "    Version is ${CORE_VERSION:=N/A} (Latest: ${GITHUB_CORE_VERSION:=N/A})"
+        echo "    Branch is ${CORE_BRANCH:=N/A}"
+        echo "    Hash is ${CORE_HASH:=N/A} (Latest: ${GITHUB_CORE_HASH:=N/A})"
+        echo "Web"
+        echo "    Version is ${WEB_VERSION:=N/A} (Latest: ${GITHUB_WEB_VERSION:=N/A})"
+        echo "    Branch is ${WEB_BRANCH:=N/A}"
+        echo "    Hash is ${WEB_HASH:=N/A} (Latest: ${GITHUB_WEB_HASH:=N/A})"
+        echo "FTL"
+        echo "    Version is ${FTL_VERSION:=N/A} (Latest: ${GITHUB_FTL_VERSION:=N/A})"
+        echo "    Branch is ${FTL_BRANCH:=N/A}"
+        echo "    Hash is ${FTL_HASH:=N/A} (Latest: ${GITHUB_FTL_HASH:=N/A})"
+    else
+        echo "Core version is ${CORE_VERSION:=N/A} (Latest: ${GITHUB_CORE_VERSION:=N/A})"
+        echo "Web version is ${WEB_VERSION:=N/A} (Latest: ${GITHUB_WEB_VERSION:=N/A})"
+        echo "FTL version is ${FTL_VERSION:=N/A} (Latest: ${GITHUB_FTL_VERSION:=N/A})"
+    fi
+}
+
+main

advanced/Scripts/whitelist.sh

@@ -1,201 +0,0 @@
-#!/usr/bin/env bash
-# (c) 2015 by Jacob Salmela
-# This file is part of Pi-hole.
-#
-# Pi-hole is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-
-if [[ $# = 0 ]]; then
-    echo "Immediately whitelists one or more domains in the hosts file"
-    echo " "
-    echo "Usage: whitelist.sh domain1 [domain2 ...]"
-    echo "  "
-    echo "Options:"
-    echo "  -d, --delmode		Remove domains from the whitelist"
-    echo "  -nr, --noreload	Update Whitelist without refreshing dnsmasq"
-    echo "  -f, --force		Force updating of the hosts files, even if there are no changes"
-    echo "  -q, --quiet		output is less verbose"
-    exit 1
-fi
-
-#globals
-whitelist=/etc/pihole/whitelist.txt
-adList=/etc/pihole/gravity.list
-reload=true
-addmode=true
-force=false
-versbose=true
-domList=()
-domToRemoveList=()
-
-piholeIPfile=/tmp/piholeIP
-piholeIPv6file=/etc/pihole/.useIPv6
-
-# Otherwise, the IP address can be taken directly from the machine, which will happen when the script is run by the user and not the installation script
-IPv4dev=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}')
-piholeIPCIDR=$(ip -o -f inet addr show dev $IPv4dev | awk '{print $4}' | awk 'END {print}')
-piholeIP=${piholeIPCIDR%/*}
-
-modifyHost=false
-
-
-if [[ -f $piholeIPv6file ]];then
-    # If the file exists, then the user previously chose to use IPv6 in the automated installer
-    piholeIPv6=$(ip -6 route get 2001:4860:4860::8888 | awk -F " " '{ for(i=1;i<=NF;i++) if ($i == "src") print $(i+1) }')
-fi
-
-
-function HandleOther(){	
-  #check validity of domain
-	validDomain=$(echo $1 | perl -ne'print if /\b((?=[a-z0-9-]{1,63}\.)(xn--)?[a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,63}\b/')
-	
-	if [ -z "$validDomain" ]; then
-		echo "::: $1 is not a valid argument or domain name"
-	else	  
-	  domList=("${domList[@]}" $validDomain)
-	fi
-}
-
-function PopWhitelistFile(){
-	#check whitelist file exists, and if not, create it
-	if [[ ! -f $whitelist ]];then
-  	  touch $whitelist
-	fi	
-	for dom in "${domList[@]}"
-	do	  
-	  if $addmode; then
-	  	AddDomain $dom
-	  else
-	    RemoveDomain $dom
-	  fi
-	done
-}
-
-function AddDomain(){
-#| sed 's/\./\\./g'
-	bool=false
-	
-	grep -Ex -q "$1" $whitelist || bool=true
-	if $bool; then
-	  #domain not found in the whitelist file, add it!
-	  if $versbose; then
-		echo -n "::: Adding $1 to whitelist.txt..."
-	  fi
-	  echo $1 >> $whitelist
-		modifyHost=true
-		if $versbose; then
-	  	echo " done!"
-	  fi
-	else
-		if $versbose; then
-			echo "::: $1 already exists in whitelist.txt, no need to add!"
-		fi
-	fi
-}
-
-function RemoveDomain(){
-  
-  bool=false
-  grep -Ex -q "$1" $whitelist || bool=true
-  if $bool; then
-  	#Domain is not in the whitelist file, no need to Remove
-  	if $versbose; then
-  	echo "::: $1 is NOT whitelisted! No need to remove"
-  	fi
-  else
-    #Domain is in the whitelist file, add to a temporary array and remove from whitelist file
-    #if $versbose; then
-    #echo "::: Un-whitelisting $dom..."
-    #fi
-    domToRemoveList=("${domToRemoveList[@]}" $1)
-    modifyHost=true	  	
-  fi  	
-}
-
-function ModifyHostFile(){	
-	 if $addmode; then
-	    #remove domains in  from hosts file
-	    if [[ -r $whitelist ]];then
-        # Remove whitelist entries
-				numberOf=$(cat $whitelist | sed '/^\s*$/d' | wc -l)
-        plural=; [[ "$numberOf" != "1" ]] && plural=s
-        echo ":::"
-        echo -n "::: Modifying HOSTS file to whitelist $numberOf domain${plural}..."
-        awk -F':' '{print $1}' $whitelist | while read line; do echo "$piholeIP $line"; done > /etc/pihole/whitelist.tmp
-        awk -F':' '{print $1}' $whitelist | while read line; do echo "$piholeIPv6 $line"; done >> /etc/pihole/whitelist.tmp
-        echo "l" >> /etc/pihole/whitelist.tmp
-        grep -F -x -v -f /etc/pihole/whitelist.tmp /etc/pihole/gravity.list > /etc/pihole/gravity.tmp        
-        rm /etc/pihole/gravity.list
-        mv /etc/pihole/gravity.tmp /etc/pihole/gravity.list
-        rm /etc/pihole/whitelist.tmp
-        echo " done!"
-	  	  
-	  	fi
-	  else
-	    #we need to add the removed domains to the hosts file
-	    echo ":::"
-	    echo "::: Modifying HOSTS file to un-whitelist domains..."
-	    for rdom in "${domToRemoveList[@]}"
-	    do	      
-	    	if [[ -n $piholeIPv6 ]];then
-	    	  echo -n ":::    Un-whitelisting $rdom on IPv4 and IPv6..."
-	    	  echo $rdom | awk -v ipv4addr="$piholeIP" -v ipv6addr="$piholeIPv6" '{sub(/\r$/,""); print ipv4addr" "$0"\n"ipv6addr" "$0}' >> $adList
-	    	  echo " done!"
-	      else
-	        echo -n ":::    Un-whitelisting $rdom on IPv4"
-	      	echo $rdom | awk -v ipv4addr="$piholeIP" '{sub(/\r$/,""); print ipv4addr" "$0}' >>$adList
-	      	echo " done!"
-	      fi
-	      echo -n ":::        Removing $rdom from whitelist.txt..."
-	      echo $rdom| sed 's/\./\\./g' | xargs -I {} perl -i -ne'print unless /'{}'(?!.)/;' $whitelist
-	      echo " done!"
-	    done
-	  fi	
-}
-
-function Reload() {
-	# Reload hosts file
-	echo ":::"
-	echo -n "::: Refresh lists in dnsmasq..."
-	dnsmasqPid=$(pidof dnsmasq)
-
-	if [[ $dnsmasqPid ]]; then
-		# service already running - reload config
-		sudo kill -HUP $dnsmasqPid
-	else
-		# service not running, start it up
-		sudo service dnsmasq start
-	fi
-	echo " done!"
-}
-
-###################################################
-
-for var in "$@"
-do
-  case "$var" in
-    "-nr"| "--noreload"  ) reload=false;;        			
-    "-d" | "--delmode"   ) addmode=false;;
-    "-f" | "--force"     ) force=true;;
-    "-q" | "--quiet"     ) versbose=false;;  			
-    *                    ) HandleOther $var;;
-  esac
-done
-
-PopWhitelistFile
-
-if $modifyHost || $force; then
-	 ModifyHostFile
-else
-  if $versbose; then
-  echo ":::"
-	echo "::: No changes need to be made"
-	exit 1
-	fi
-fi
-
-if $reload; then
-	Reload
-fi

advanced/Templates/gravity.db.sql

@@ -0,0 +1,200 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+
+CREATE TABLE "group"
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    name TEXT UNIQUE NOT NULL,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    description TEXT
+);
+INSERT INTO "group" (id,enabled,name,description) VALUES (0,1,'Default','The default group');
+
+CREATE TABLE domainlist
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    type INTEGER NOT NULL DEFAULT 0,
+    domain TEXT NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    comment TEXT,
+    UNIQUE(domain, type)
+);
+
+CREATE TABLE adlist
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    address TEXT NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT 1,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    comment TEXT,
+    date_updated INTEGER,
+    number INTEGER NOT NULL DEFAULT 0,
+    invalid_domains INTEGER NOT NULL DEFAULT 0,
+    status INTEGER NOT NULL DEFAULT 0,
+    abp_entries INTEGER NOT NULL DEFAULT 0,
+    type INTEGER NOT NULL DEFAULT 0,
+    UNIQUE(address, type)
+);
+
+CREATE TABLE adlist_by_group
+(
+    adlist_id INTEGER NOT NULL REFERENCES adlist (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (adlist_id, group_id)
+);
+
+CREATE TABLE gravity
+(
+    domain TEXT NOT NULL,
+    adlist_id INTEGER NOT NULL REFERENCES adlist (id)
+);
+
+CREATE TABLE antigravity
+(
+    domain TEXT NOT NULL,
+    adlist_id INTEGER NOT NULL REFERENCES adlist (id)
+);
+
+CREATE TABLE info
+(
+    property TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+);
+
+INSERT INTO "info" VALUES('version','19');
+
+CREATE TABLE domainlist_by_group
+(
+    domainlist_id INTEGER NOT NULL REFERENCES domainlist (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (domainlist_id, group_id)
+);
+
+CREATE TABLE client
+(
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ip TEXT NOT NULL UNIQUE,
+    date_added INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    date_modified INTEGER NOT NULL DEFAULT (cast(strftime('%s', 'now') as int)),
+    comment TEXT
+);
+
+CREATE TABLE client_by_group
+(
+    client_id INTEGER NOT NULL REFERENCES client (id),
+    group_id INTEGER NOT NULL REFERENCES "group" (id),
+    PRIMARY KEY (client_id, group_id)
+);
+
+CREATE TRIGGER tr_adlist_update AFTER UPDATE OF address,enabled,comment ON adlist
+    BEGIN
+      UPDATE adlist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER tr_client_update AFTER UPDATE ON client
+    BEGIN
+      UPDATE client SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE ip = NEW.ip;
+    END;
+
+CREATE TRIGGER tr_domainlist_update AFTER UPDATE ON domainlist
+    BEGIN
+      UPDATE domainlist SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE domain = NEW.domain;
+    END;
+
+CREATE VIEW vw_whitelist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 0
+    ORDER BY domainlist.id;
+
+CREATE VIEW vw_blacklist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 1
+    ORDER BY domainlist.id;
+
+CREATE VIEW vw_regex_whitelist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 2
+    ORDER BY domainlist.id;
+
+CREATE VIEW vw_regex_blacklist AS SELECT domain, domainlist.id AS id, domainlist_by_group.group_id AS group_id
+    FROM domainlist
+    LEFT JOIN domainlist_by_group ON domainlist_by_group.domainlist_id = domainlist.id
+    LEFT JOIN "group" ON "group".id = domainlist_by_group.group_id
+    WHERE domainlist.enabled = 1 AND (domainlist_by_group.group_id IS NULL OR "group".enabled = 1)
+    AND domainlist.type = 3
+    ORDER BY domainlist.id;
+
+CREATE VIEW vw_gravity AS SELECT domain, adlist.id AS adlist_id, adlist_by_group.group_id AS group_id
+    FROM gravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = gravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = gravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1);
+
+CREATE VIEW vw_antigravity AS SELECT domain, adlist.id AS adlist_id, adlist_by_group.group_id AS group_id
+    FROM antigravity
+    LEFT JOIN adlist_by_group ON adlist_by_group.adlist_id = antigravity.adlist_id
+    LEFT JOIN adlist ON adlist.id = antigravity.adlist_id
+    LEFT JOIN "group" ON "group".id = adlist_by_group.group_id
+    WHERE adlist.enabled = 1 AND (adlist_by_group.group_id IS NULL OR "group".enabled = 1) AND adlist.type = 1;
+
+CREATE VIEW vw_adlist AS SELECT DISTINCT address, id, type
+    FROM adlist
+    WHERE enabled = 1
+    ORDER BY id;
+
+CREATE TRIGGER tr_domainlist_add AFTER INSERT ON domainlist
+    BEGIN
+      INSERT INTO domainlist_by_group (domainlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_client_add AFTER INSERT ON client
+    BEGIN
+      INSERT INTO client_by_group (client_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_adlist_add AFTER INSERT ON adlist
+    BEGIN
+      INSERT INTO adlist_by_group (adlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_group_update AFTER UPDATE ON "group"
+    BEGIN
+      UPDATE "group" SET date_modified = (cast(strftime('%s', 'now') as int)) WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER tr_group_zero AFTER DELETE ON "group"
+    BEGIN
+      INSERT OR IGNORE INTO "group" (id,enabled,name) VALUES (0,1,'Default');
+    END;
+
+CREATE TRIGGER tr_domainlist_delete AFTER DELETE ON domainlist
+    BEGIN
+      DELETE FROM domainlist_by_group WHERE domainlist_id = OLD.id;
+    END;
+
+CREATE TRIGGER tr_adlist_delete AFTER DELETE ON adlist
+    BEGIN
+      DELETE FROM adlist_by_group WHERE adlist_id = OLD.id;
+    END;
+
+CREATE TRIGGER tr_client_delete AFTER DELETE ON client
+    BEGIN
+      DELETE FROM client_by_group WHERE client_id = OLD.id;
+    END;
+
+COMMIT;

advanced/Templates/gravity_copy.sql

@@ -0,0 +1,42 @@
+.timeout 30000
+
+ATTACH DATABASE '/etc/pihole/gravity.db' AS OLD;
+
+BEGIN TRANSACTION;
+
+DROP TRIGGER tr_domainlist_add;
+DROP TRIGGER tr_client_add;
+DROP TRIGGER tr_adlist_add;
+
+INSERT OR REPLACE INTO "group" SELECT * FROM OLD."group";
+
+INSERT OR REPLACE INTO domainlist SELECT * FROM OLD.domainlist;
+DELETE FROM OLD.domainlist_by_group WHERE domainlist_id NOT IN (SELECT id FROM OLD.domainlist);
+INSERT OR REPLACE INTO domainlist_by_group SELECT * FROM OLD.domainlist_by_group;
+
+INSERT OR REPLACE INTO adlist SELECT * FROM OLD.adlist;
+DELETE FROM OLD.adlist_by_group WHERE adlist_id NOT IN (SELECT id FROM OLD.adlist);
+INSERT OR REPLACE INTO adlist_by_group SELECT * FROM OLD.adlist_by_group;
+
+INSERT OR REPLACE INTO client SELECT * FROM OLD.client;
+DELETE FROM OLD.client_by_group WHERE client_id NOT IN (SELECT id FROM OLD.client);
+INSERT OR REPLACE INTO client_by_group SELECT * FROM OLD.client_by_group;
+
+
+CREATE TRIGGER tr_domainlist_add AFTER INSERT ON domainlist
+    BEGIN
+      INSERT INTO domainlist_by_group (domainlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_client_add AFTER INSERT ON client
+    BEGIN
+      INSERT INTO client_by_group (client_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+CREATE TRIGGER tr_adlist_add AFTER INSERT ON adlist
+    BEGIN
+      INSERT INTO adlist_by_group (adlist_id, group_id) VALUES (NEW.id, 0);
+    END;
+
+
+COMMIT;

advanced/Templates/logrotate

@@ -0,0 +1,32 @@
+/var/log/pihole/pihole.log {
+    # su #
+    daily
+    copytruncate
+    rotate 5
+    compress
+    delaycompress
+    notifempty
+    nomail
+}
+
+/var/log/pihole/FTL.log {
+    # su #
+    weekly
+    copytruncate
+    rotate 3
+    compress
+    delaycompress
+    notifempty
+    nomail
+}
+
+/var/log/pihole/webserver.log {
+    # su #
+    weekly
+    copytruncate
+    rotate 3
+    compress
+    delaycompress
+    notifempty
+    nomail
+}

advanced/Templates/pihole-FTL-poststop.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+
+# Source utils.sh for getFTLConfigValue()
+PI_HOLE_SCRIPT_DIR='/opt/pihole'
+utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+# shellcheck disable=SC1090
+. "${utilsfile}"
+
+# Get file paths
+FTL_PID_FILE="$(getFTLConfigValue files.pid)"
+
+# Cleanup
+rm -f /run/pihole/FTL.sock /dev/shm/FTL-* "${FTL_PID_FILE}"

advanced/Templates/pihole-FTL-prestart.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env sh
+
+# Source utils.sh for getFTLConfigValue()
+PI_HOLE_SCRIPT_DIR='/opt/pihole'
+utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+# shellcheck disable=SC1090
+. "${utilsfile}"
+
+# Get file paths
+FTL_PID_FILE="$(getFTLConfigValue files.pid)"
+
+# Ensure that permissions are set so that pihole-FTL can edit all necessary files
+# shellcheck disable=SC2174
+mkdir -pm 0640 /var/log/pihole
+chown -R pihole:pihole /etc/pihole /var/log/pihole
+chmod -R 0640 /var/log/pihole
+chmod -R 0660 /etc/pihole
+
+# Logrotate config file need to be owned by root and must not be writable by group and others
+chown root:root /etc/pihole/logrotate
+chmod 0644 /etc/pihole/logrotate
+
+# allow all users to enter the directories
+chmod 0755 /etc/pihole /var/log/pihole
+
+# allow pihole to access subdirs in /etc/pihole (sets execution bit on dirs)
+# credits https://stackoverflow.com/a/11512211
+find /etc/pihole -type d -exec chmod 0755 {} \;
+
+# Touch files to ensure they exist (create if non-existing, preserve if existing)
+[ -f "${FTL_PID_FILE}" ] || install -D -m 644 -o pihole -g pihole /dev/null "${FTL_PID_FILE}"
+[ -f /var/log/pihole/FTL.log ] || install -m 640 -o pihole -g pihole /dev/null /var/log/pihole/FTL.log
+[ -f /var/log/pihole/pihole.log ] || install -m 640 -o pihole -g pihole /dev/null /var/log/pihole/pihole.log
+[ -f /etc/pihole/dhcp.leases ] || install -m 644 -o pihole -g pihole /dev/null /etc/pihole/dhcp.leases

advanced/Templates/pihole-FTL.service

@@ -0,0 +1,122 @@
+#!/usr/bin/env sh
+### BEGIN INIT INFO
+# Provides:          pihole-FTL
+# Required-Start:    $remote_fs $syslog $network
+# Required-Stop:     $remote_fs $syslog $network
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: pihole-FTL daemon
+# Description:       Enable service provided by pihole-FTL daemon
+### END INIT INFO
+
+# Source utils.sh for getFTLConfigValue(), getFTLPID()
+PI_HOLE_SCRIPT_DIR="/opt/pihole"
+utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+# shellcheck disable=SC1090
+. "${utilsfile}"
+
+
+is_running() {
+  if [ -d "/proc/${FTL_PID}" ]; then
+    return 0
+  fi
+  return 1
+}
+
+cleanup() {
+    # Run post-stop script, which does cleanup among runtime files
+    sh "${PI_HOLE_SCRIPT_DIR}/pihole-FTL-poststop.sh"
+}
+
+
+# Start the service
+start() {
+  if is_running; then
+    echo "pihole-FTL is already running"
+  else
+    # Run pre-start script, which pre-creates all expected files with correct permissions
+    sh "${PI_HOLE_SCRIPT_DIR}/pihole-FTL-prestart.sh"
+
+    if setcap CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_NET_ADMIN,CAP_SYS_NICE,CAP_IPC_LOCK,CAP_CHOWN,CAP_SYS_TIME+eip "/usr/bin/pihole-FTL"; then
+      su -s /bin/sh -c "/usr/bin/pihole-FTL" pihole
+    else
+      echo "Warning: Starting pihole-FTL as root because setting capabilities is not supported on this system"
+      /usr/bin/pihole-FTL
+    fi
+    rc=$?
+    # Cleanup if startup failed
+    if [ "${rc}" != 0 ]; then
+        cleanup
+        exit $rc
+    fi
+    echo
+  fi
+}
+
+# Stop the service
+stop() {
+  if is_running; then
+    kill "${FTL_PID}"
+    for i in 1 2 3 4 5; do
+      if ! is_running; then
+        break
+      fi
+
+      printf "."
+      sleep 1
+    done
+    echo
+
+    if is_running; then
+      echo "Not stopped; may still be shutting down or shutdown may have failed, killing now"
+      kill -9 "${FTL_PID}"
+    else
+      echo "Stopped"
+    fi
+  else
+    echo "Not running"
+  fi
+  cleanup
+  echo
+}
+
+# Indicate the service status
+status() {
+  if is_running; then
+    echo "[ ok ] pihole-FTL is running"
+    exit 0
+  else
+    echo "[    ] pihole-FTL is not running"
+    exit 1
+  fi
+}
+
+
+### main logic ###
+
+# catch sudden termination
+trap 'cleanup; exit 1' INT HUP TERM ABRT
+
+# Get FTL's PID file path
+FTL_PID_FILE="$(getFTLConfigValue files.pid)"
+
+# Get FTL's current PID
+FTL_PID="$(getFTLPID "${FTL_PID_FILE}")"
+
+case "$1" in
+  stop)
+        stop
+        ;;
+  status)
+        status
+        ;;
+  start|restart|reload|condrestart)
+        stop
+        start
+        ;;
+  *)
+        echo "Usage: $0 {start|stop|restart|reload|status}"
+        exit 1
+esac
+
+exit 0

advanced/Templates/pihole-FTL.systemd

@@ -0,0 +1,41 @@
+[Unit]
+Description=Pi-hole FTL
+# This unit is supposed to indicate when network functionality is available, but it is only
+# very weakly defined what that is supposed to mean, with one exception: at shutdown, a unit
+# that is ordered after network-online.target will be stopped before the network
+Wants=network-online.target
+After=network-online.target
+# A target that should be used as synchronization point for all host/network name service lookups.
+# All services for which the availability of full host/network name resolution is essential should
+# be ordered after this target, but not pull it in.
+Wants=nss-lookup.target
+Before=nss-lookup.target
+
+# Limit (re)start loop to 5 within 1 minute
+StartLimitBurst=5
+StartLimitIntervalSec=60s
+
+[Service]
+User=pihole
+PermissionsStartOnly=true
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN CAP_SYS_TIME
+
+ExecStartPre=/opt/pihole/pihole-FTL-prestart.sh
+ExecStart=/usr/bin/pihole-FTL -f
+Restart=on-failure
+RestartSec=5s
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStopPost=/opt/pihole/pihole-FTL-poststop.sh
+
+# Use graceful shutdown with a reasonable timeout
+TimeoutStopSec=10s
+
+# Make /usr, /boot, /etc and possibly some more folders read-only...
+ProtectSystem=full
+# ... except /etc/pihole
+# This merely retains r/w access rights, it does not add any new.
+# Must still be writable on the host!
+ReadWriteDirectories=/etc/pihole
+
+[Install]
+WantedBy=multi-user.target

advanced/Templates/pihole.cron

@@ -0,0 +1,33 @@
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Updates ad sources every week
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+#
+#
+#
+# This file is under source-control of the Pi-hole installation and update
+# scripts, any changes made to this file will be overwritten when the software
+# is updated or re-installed. Please make any changes to the appropriate crontab
+# or other cron file snippets.
+
+# Pi-hole: Update the ad sources once a week on Sunday at a random time in the
+#          early morning. Download any updates from the adlists
+#          Squash output to log, then splat the log to stdout on error to allow for
+#          standard crontab job error handling.
+59 1    * * 7   root    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updateGravity >/var/log/pihole/pihole_updateGravity.log || cat /var/log/pihole/pihole_updateGravity.log
+
+# Pi-hole: Flush the log daily at 00:00
+#          The flush script will use logrotate if available
+#          parameter "once": logrotate only once (default is twice)
+#          parameter "quiet": don't print messages
+00 00   * * *   root    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole flush once quiet
+
+@reboot root /usr/sbin/logrotate --state /var/lib/logrotate/pihole /etc/pihole/logrotate
+
+# Pi-hole: Grab remote and local version every 24 hours
+59 17  * * *   root    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker
+@reboot root    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker reboot

advanced/bash-completion/pihole

@@ -0,0 +1,51 @@
+_pihole() {
+    local cur prev opts opts_checkout opts_debug opts_logging opts_query opts_update opts_version
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    prev="${COMP_WORDS[COMP_CWORD-1]}"
+    prev2="${COMP_WORDS[COMP_CWORD-2]}"
+
+    case "${prev}" in
+        "pihole")
+            opts="allow allow-regex allow-wild deny checkout debug disable enable flush help logging query reconfigure regex reloaddns reloadlists status tail uninstall updateGravity updatePihole version wildcard arpflush api"
+            COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+        ;;
+        "allow"|"deny"|"wildcard"|"regex"|"allow-regex"|"allow-wild")
+            opts_lists="\not \--delmode \--quiet \--list \--help"
+            COMPREPLY=( $(compgen -W "${opts_lists}" -- ${cur}) )
+        ;;
+        "checkout")
+            opts_checkout="core ftl web master dev"
+            COMPREPLY=( $(compgen -W "${opts_checkout}" -- ${cur}) )
+        ;;
+        "debug")
+            opts_debug="-a"
+            COMPREPLY=( $(compgen -W "${opts_debug}" -- ${cur}) )
+        ;;
+        "logging")
+            opts_logging="on off 'off noflush'"
+            COMPREPLY=( $(compgen -W "${opts_logging}" -- ${cur}) )
+        ;;
+        "query")
+            opts_query="--partial --all"
+            COMPREPLY=( $(compgen -W "${opts_query}" -- ${cur}) )
+        ;;
+        "updatePihole"|"-up")
+            opts_update="--check-only"
+            COMPREPLY=( $(compgen -W "${opts_update}" -- ${cur}) )
+        ;;
+        "core"|"admin"|"ftl")
+            if [[ "$prev2" == "checkout" ]]; then
+                opts_checkout="master dev"
+                COMPREPLY=( $(compgen -W "${opts_checkout}" -- ${cur}) )
+            else
+                return 1
+            fi
+        ;;
+        *)
+        return 1
+        ;;
+    esac
+    return 0
+}
+complete -F _pihole pihole

advanced/dnsmasq.conf

@@ -1,50 +0,0 @@
-# If you want dnsmasq to read another file, as well as /etc/hosts, use
-# this.
-addn-hosts=/etc/pihole/gravity.list
-
-# The following two options make you a better netizen, since they
-# tell dnsmasq to filter out queries which the public DNS cannot
-# answer, and which load the servers (especially the root servers)
-# unnecessarily. If you have a dial-on-demand link they also stop
-# these requests from bringing up the link unnecessarily.
-
-# Never forward plain names (without a dot or domain part)
-domain-needed
-# Never forward addresses in the non-routed address spaces.
-bogus-priv
-
-# If you don't want dnsmasq to read /etc/resolv.conf or any other
-# file, getting its servers from this file instead (see below), then
-# uncomment this.
-no-resolv
-
-# Add other name servers here, with domain specs if they are for
-# non-public domains.
-server=8.8.8.8
-server=8.8.4.4
-
-# If you want dnsmasq to listen for DHCP and DNS requests only on
-# specified interfaces (and the loopback) give the name of the
-# interface (eg eth0) here.
-interface=@INT@
-# Or which to listen on by address (remember to include 127.0.0.1 if
-# you use this.)
-listen-address=127.0.0.1
-
-# Set the cachesize here.
-cache-size=10000
-
-# For debugging purposes, log each DNS query as it passes through
-# dnsmasq.
-log-queries
-log-facility=/var/log/pihole.log
-
-# Normally responses which come from /etc/hosts and the DHCP lease
-# file have Time-To-Live set as zero, which conventionally means
-# do not cache further. If you are happy to trade lower load on the
-# server for potentially stale date, you can set a time-to-live (in
-# seconds) here.
-local-ttl=300
-
-# This allows it to continue functioning without being blocked by syslog, and allows syslog to use dnsmasq for DNS queries without risking deadlock
-log-async

advanced/dphys-swapfile

@@ -1 +0,0 @@
-CONF_SWAPSIZE=500

advanced/index.html

@@ -1,4 +0,0 @@
-<html>
-<body>
-</body>
-</html>

advanced/lighttpd.conf

@@ -1,45 +0,0 @@
-server.modules = (
-	"mod_access",
-	"mod_accesslog",
-	"mod_expire",
-	"mod_compress",
- 	"mod_redirect",
-	"mod_setenv",
-	"mod_rewrite"
-)
-
-server.document-root        = "/var/www/html"
-server.error-handler-404	= "pihole/index.html"
-server.upload-dirs          = ( "/var/cache/lighttpd/uploads" )
-server.errorlog             = "/var/log/lighttpd/error.log"
-server.pid-file             = "/var/run/lighttpd.pid"
-server.username             = "www-data"
-server.groupname            = "www-data"
-server.port                 = 80
-accesslog.filename			= "/var/log/lighttpd/access.log"
-accesslog.format			= "%{%s}t|%V|%r|%s|%b"
-
-
-index-file.names            = ( "index.php", "index.html", "index.lighttpd.html" )
-url.access-deny             = ( "~", ".inc" )
-static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
-
-compress.cache-dir          = "/var/cache/lighttpd/compress/"
-compress.filetype           = ( "application/javascript", "text/css", "text/html", "text/plain" )
-
-# default listening port for IPv6 falls back to the IPv4 port
-include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
-include_shell "/usr/share/lighttpd/create-mime.assign.pl"
-include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
-
-# If the URL starts with /admin, it is the Web interface
-$HTTP["url"] =~ "^/admin/" {
-	# Create a response header for debugging using curl -I
-	setenv.add-response-header = ( "X-Pi-hole" => "The Pi-hole Web interface is working!" )
-}
-
-# If the URL does not start with /admin, then it is a query for an ad domain
-$HTTP["url"] =~ "^(?!/admin)/.*" {
-	# Create a response header for debugging using curl -I
-	setenv.add-response-header = ( "X-Pi-hole" => "A black hole for Internet advertisements." )
-}

advanced/pihole.cron

@@ -1,15 +0,0 @@
-# Pi-hole: Update the ad sources once a week on Sunday at 01:59
-#          Download any updates from the ad lists
-59 1    * * 7   root    /usr/local/bin/gravity.sh
-
-# Pi-hole: Update the Web interface shortly after gravity runs
-#          This should also update the version number if it is changed in the dashboard repo
-30 2    * * 7   root    /usr/local/bin/updateDashboard.sh
-
-# Pi-hole: Parse the log file before it is flushed and save the stats to a database
-#          This will be used for a historical view of your Pi-hole's performance
-#50 23  * * *   root    /usr/local/bin/dailyLog.sh
-
-# Pi-hole: Flush the log daily at 11:58 so it doesn't get out of control
-#          Stats will be viewable in the Web interface thanks to the cron job above
-58 23   * * *   root    /usr/local/bin/piholeLogFlush.sh

automated install/uninstall.sh

@@ -1,71 +1,162 @@
 #!/usr/bin/env bash
-# Completely uninstalls the Pi-hole
+# Pi-hole: A black hole for Internet advertisements
-# (c) 2015 by Jacob Salmela
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
-# This file is part of Pi-hole.
+# Network-wide ad blocking via your own hardware.
 #
-# Pi-hole is free software: you can redistribute it and/or modify
+# Completely uninstalls Pi-hole
-# it under the terms of the GNU General Public License as published by
+#
-# the Free Software Foundation, either version 2 of the License, or
+# This file is copyright under the latest version of the EUPL.
-# (at your option) any later version.
+# Please see LICENSE file for your rights under this license.
+
+source "/opt/pihole/COL_TABLE"
+
+while true; do
+    read -rp "  ${QST} Are you sure you would like to remove ${COL_WHITE}Pi-hole${COL_NC}? [y/N] " answer
+    case ${answer} in
+        [Yy]* ) break;;
+        * ) echo -e "${OVER}  ${COL_LIGHT_GREEN}Uninstall has been canceled${COL_NC}"; exit 0;;
+    esac
+done
 
 # Must be root to uninstall
-if [[ $EUID -eq 0 ]];then
+str="Root user check"
-	echo "You are root."
+if [[ ${EUID} -eq 0 ]]; then
+    echo -e "  ${TICK} ${str}"
 else
-	echo "sudo will be used for the install."
+    # Check if sudo is actually installed
-  # Check if it is actually installed
+    # If it isn't, exit because the uninstall can not complete
-  # If it isn't, exit because the unnstall cannot complete
+    if [ -x "$(command -v sudo)" ]; then
-  if [[ $(dpkg-query -s sudo) ]];then
+        export SUDO="sudo"
-		export SUDO="sudo"
+    else
-  else
+        echo -e "  ${CROSS} ${str}
-    echo "Please install sudo or run this as root."
+            Script called with non-root privileges
-    exit 1
+            The Pi-hole requires elevated privileges to uninstall"
-  fi
+        exit 1
+    fi
 fi
 
+readonly PI_HOLE_FILES_DIR="/etc/.pihole"
+SKIP_INSTALL="true"
+source "${PI_HOLE_FILES_DIR}/automated install/basic-install.sh"
+
+# package_manager_detect() sourced from basic-install.sh
+package_manager_detect
+
+
+removeMetaPackage() {
+    # Purge Pi-hole meta package
+    echo ""
+    echo -ne "  ${INFO} Removing Pi-hole meta package...";
+    eval "${SUDO}" "${PKG_REMOVE}" "pihole-meta" &> /dev/null;
+    echo -e "${OVER}  ${INFO} Removed Pi-hole meta package";
+
+}
+
+removePiholeFiles() {
+    # Only web directories/files that are created by Pi-hole should be removed
+    echo -ne "  ${INFO} Removing Web Interface..."
+    ${SUDO} rm -rf /var/www/html/admin &> /dev/null
+
+
+    # If the web directory is empty after removing these files, then the parent html directory can be removed.
+    if [ -d "/var/www/html" ]; then
+        if [[ ! "$(ls -A /var/www/html)" ]]; then
+            ${SUDO} rm -rf /var/www/html &> /dev/null
+        fi
+    fi
+    echo -e "${OVER}  ${TICK} Removed Web Interface"
+
+    # Attempt to preserve backwards compatibility with older versions
+    # to guarantee no additional changes were made to /etc/crontab after
+    # the installation of pihole, /etc/crontab.pihole should be permanently
+    # preserved.
+    if [[ -f /etc/crontab.orig ]]; then
+        ${SUDO} mv /etc/crontab /etc/crontab.pihole
+        ${SUDO} mv /etc/crontab.orig /etc/crontab
+        ${SUDO} service cron restart
+        echo -e "  ${TICK} Restored the default system cron"
+    fi
+
+    # Attempt to preserve backwards compatibility with older versions
+    if [[ -f /etc/cron.d/pihole ]];then
+        ${SUDO} rm -f /etc/cron.d/pihole &> /dev/null
+        echo -e "  ${TICK} Removed /etc/cron.d/pihole"
+    fi
+
+    ${SUDO} rm -rf /var/log/*pihole* &> /dev/null
+    ${SUDO} rm -rf /var/log/pihole/*pihole* &> /dev/null
+    ${SUDO} rm -rf /etc/pihole/ &> /dev/null
+    ${SUDO} rm -rf /etc/.pihole/ &> /dev/null
+    ${SUDO} rm -rf /opt/pihole/ &> /dev/null
+    ${SUDO} rm -f /usr/local/bin/pihole &> /dev/null
+    ${SUDO} rm -f /etc/bash_completion.d/pihole &> /dev/null
+    ${SUDO} rm -f /etc/sudoers.d/pihole &> /dev/null
+    echo -e "  ${TICK} Removed config files"
+
+    # Restore Resolved
+    if [[ -e /etc/systemd/resolved.conf.orig ]]; then
+        ${SUDO} cp -p /etc/systemd/resolved.conf.orig /etc/systemd/resolved.conf
+        systemctl reload-or-restart systemd-resolved
+    fi
+
+    # Remove FTL
+    if command -v pihole-FTL &> /dev/null; then
+        echo -ne "  ${INFO} Removing pihole-FTL..."
+        if [[ -x "$(command -v systemctl)" ]]; then
+            systemctl stop pihole-FTL
+        else
+            service pihole-FTL stop
+        fi
+        ${SUDO} rm -f /etc/systemd/system/pihole-FTL.service
+        if [[ -d '/etc/systemd/system/pihole-FTL.service.d' ]]; then
+            read -rp "  ${QST} FTL service override directory /etc/systemd/system/pihole-FTL.service.d detected. Do you wish to remove this from your system? [y/N] " answer
+            case $answer in
+                [yY]*)
+                    echo -ne "  ${INFO} Removing /etc/systemd/system/pihole-FTL.service.d..."
+                    ${SUDO} rm -R /etc/systemd/system/pihole-FTL.service.d
+                    echo -e "${OVER}  ${INFO} Removed /etc/systemd/system/pihole-FTL.service.d"
+                ;;
+                *) echo -e "  ${INFO} Leaving /etc/systemd/system/pihole-FTL.service.d in place.";;
+            esac
+        fi
+        ${SUDO} rm -f /etc/init.d/pihole-FTL
+        ${SUDO} rm -f /usr/bin/pihole-FTL
+        echo -e "${OVER}  ${TICK} Removed pihole-FTL"
+    fi
+
+    # If the pihole manpage exists, then delete and rebuild man-db
+    if [[ -f /usr/local/share/man/man8/pihole.8 ]]; then
+        ${SUDO} rm -f /usr/local/share/man/man8/pihole.8 /usr/local/share/man/man8/pihole-FTL.8 /usr/local/share/man/man5/pihole-FTL.conf.5
+        ${SUDO} mandb -q &>/dev/null
+        echo -e "  ${TICK} Removed pihole man page"
+    fi
+
+    # If the pihole user exists, then remove
+    if id "pihole" &> /dev/null; then
+        if ${SUDO} userdel -r pihole 2> /dev/null; then
+            echo -e "  ${TICK} Removed 'pihole' user"
+        else
+            echo -e "  ${CROSS} Unable to remove 'pihole' user"
+        fi
+    fi
+    # If the pihole group exists, then remove
+    if getent group "pihole" &> /dev/null; then
+        if ${SUDO} groupdel pihole 2> /dev/null; then
+            echo -e "  ${TICK} Removed 'pihole' group"
+        else
+            echo -e "  ${CROSS} Unable to remove 'pihole' group"
+        fi
+    fi
+
+    echo -e "\\n   We're sorry to see you go, but thanks for checking out Pi-hole!
+       If you need help, reach out to us on GitHub, Discourse, Reddit or Twitter
+       Reinstall at any time: ${COL_WHITE}curl -sSL https://install.pi-hole.net | bash${COL_NC}
+
+      ${COL_LIGHT_RED}Please reset the DNS on your router/clients to restore internet connectivity${COL_NC}
+      ${INFO} Pi-hole's meta package has been removed, use the 'autoremove' function from your package manager to remove unused dependencies${COL_NC}
+      ${COL_LIGHT_GREEN}Uninstallation Complete! ${COL_NC}"
+}
 
 ######### SCRIPT ###########
-$SUDO apt-get -y remove --purge dnsutils bc toilet
+removeMetaPackage
-$SUDO apt-get -y remove --purge dnsmasq
+removePiholeFiles
-$SUDO apt-get -y remove --purge lighttpd php5-common php5-cgi php5
-
-# Only web directories/files that are created by pihole should be removed.
-echo "Removing the Pi-hole Web server files..."
-$SUDO rm -rf /var/www/html/admin
-$SUDO rm -rf /var/www/html/pihole
-$SUDO rm /var/www/html/index.lighttpd.orig
-
-# If the web directory is empty after removing these files, then the parent html folder can be removed.
-if [[ ! "$(ls -A /var/www/html)" ]]; then
-    $SUDO rm -rf /var/www/html
-fi
-
-echo "Removing dnsmasq config files..."
-$SUDO rm /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
-
-# Attempt to preserve backwards compatibility with older versions
-# to guarantee no additional changes were made to /etc/crontab after
-# the installation of pihole, /etc/crontab.pihole should be permanently
-# preserved.
-if [[ -f /etc/crontab.orig ]]; then
-  echo "Initial Pi-hole cron detected.  Restoring the default system cron..."
-	$SUDO mv /etc/crontab /etc/crontab.pihole
-	$SUDO mv /etc/crontab.orig /etc/crontab
-	$SUDO service cron restart
-fi
-
-# Attempt to preserve backwards compatibility with older versions
-if [[ -f /etc/cron.d/pihole ]];then
-  echo "Removing cron.d/pihole..."
-	$SUDO rm /etc/cron.d/pihole
-fi
-
-echo "Removing config files and scripts..."
-$SUDO rm /etc/dnsmasq.conf
-$SUDO rm -rf /etc/lighttpd/
-$SUDO rm /var/log/pihole.log
-$SUDO rm /usr/local/bin/gravity.sh
-$SUDO rm /usr/local/bin/chronometer.sh
-$SUDO rm /usr/local/bin/whitelist.sh
-$SUDO rm /usr/local/bin/piholeLogFlush.sh
-$SUDO rm -rf /etc/pihole/

block hulu ads/lighttpd.conf

@@ -1,32 +0,0 @@
-server.modules = (
-	"mod_access",
-	"mod_alias",
-	"mod_compress",
- 	"mod_redirect",
-   "mod_rewrite"
-)
-
-server.document-root        = "/var/www"
-server.upload-dirs          = ( "/var/cache/lighttpd/uploads" )
-server.errorlog             = "/var/log/lighttpd/error.log"
-server.pid-file             = "/var/run/lighttpd.pid"
-server.username             = "www-data"
-server.groupname            = "www-data"
-server.port                 = 80
-
-
-index-file.names            = ( "index.php", "index.html", "index.lighttpd.html" )
-url.access-deny             = ( "~", ".inc" )
-static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
-
-compress.cache-dir          = "/var/cache/lighttpd/compress/"
-compress.filetype           = ( "application/javascript", "text/css", "text/html", "text/plain" )
-
-# default listening port for IPv6 falls back to the IPv4 port
-include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
-include_shell "/usr/share/lighttpd/create-mime.assign.pl"
-include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
-
-$HTTP["host"] =~ "ads.hulu.com|ads-v-darwin.hulu.com" {
-	url.redirect = ( ".*" => "http://192.168.1.101:8200/MediaItems/19.mov")
-}

block hulu ads/minidlna.conf

@@ -1,6 +0,0 @@
-media_dir=V,/var/lib/minidlna/videos/
-port=8200
-friendly_name=pihole
-serial=12345678
-model_number=1
-inotify=yes

manpages/pihole.8

@@ -0,0 +1,329 @@
+.TH "Pi-hole" "8" "Pi-hole" "Pi-hole" "April 2020"
+.SH "NAME"
+
+Pi-hole : A black-hole for internet advertisements
+.br
+.SH "SYNOPSIS"
+
+\fBpihole\fR (\fB-allow\fR|\fB-deny\fR) [options] domain(s)
+.br
+\fBpihole\fR (\fB--allow-regex\fR|\fB--regex\fR) [options] domain(s)
+.br
+\fBpihole\fR (\fB--allow-wild\fR|\fB--wild\fR) [options] domain(s)
+.br
+\fBpihole setpassword\fR password
+.br
+\fBpihole\fR \fB-d\fR [-a] [-c]
+.br
+\fBpihole -f
+.br
+pihole -r
+.br
+\fBpihole\fR \fB-t\fR [arg]
+.br
+\fBpihole -g\fR
+.br
+\fBpihole\fR -\fBq\fR [options]
+.br
+\fBpihole\fR \fB-l\fR (\fBon|off|off noflush\fR)
+.br
+\fBpihole -up \fR[--check-only]
+.br
+\fBpihole -v\fR
+.br
+\fBpihole uninstall\fR
+.br
+\fBpihole status\fR
+.br
+\fBpihole reloaddns\fR
+.br
+\fBpihole reloadlists\fR
+.br
+\fBpihole\fR (\fBenable\fR|\fBdisable\fR [time])
+.br
+\fBpihole\fR \fBcheckout\fR repo [branch]
+.br
+\fBpihole\fR \api\fR endpoint
+.br
+\fBpihole\fR \fBhelp\fR
+.br
+.SH "DESCRIPTION"
+
+Available commands and options:
+.br
+
+\fBallow, allowlist\fR [options] [<domain1> <domain2 ...>]
+.br
+    Adds or removes specified domain or domains to the Allowlist
+.br
+
+\fBdeny, denylist\fR [options] [<domain1> <domain2 ...>]
+.br
+    Adds or removes specified domain or domains to the denylist
+.br
+
+\fB--regex, regex\fR [options] [<regex1> <regex2 ...>]
+.br
+    Add or removes specified regex filter to the regex denylist
+.br
+
+\fB--allow-regex\fR [options] [<regex1> <regex2 ...>]
+.br
+    Add or removes specified regex filter to the regex allowlist
+.br
+
+\fB--wild, wildcard\fR [options] [<domain1> <domain2 ...>]
+.br
+    Add or removes specified domain to the wildcard denylist
+.br
+
+\fB--allow-wild\fR [options] [<domain1> <domain2 ...>]
+.br
+    Add or removes specified domain to the wildcard allowlist
+.br
+
+    (Allow-/denylist manipulation options):
+.br
+      not, -d, --delmode  Remove domain(s) from the list
+.br
+      -q, --quiet         Make output less verbose
+.br
+      -l, --list          Display all your listed domains
+.br
+
+\fB-d, debug\fR [-a]
+.br
+    Start a debugging session
+.br
+
+      -a                Enable automated debugging
+      -c                Include a Pi-hole database integrity check
+.br
+
+\fB-f, flush\fR
+.br
+    Flush the Pi-hole log
+.br
+
+\fB-r, reconfigure\fR
+.br
+    Reconfigure or Repair Pi-hole subsystems
+.br
+
+\fB-t, tail\fR [arg]
+.br
+    View the live output of the Pi-hole log
+.br
+
+      [arg]             Optional argument to filter the log for
+                        (regular expressions are supported)
+.br
+
+\fB-g, updateGravity\fR
+.br
+    Update the list of ad-serving domains
+.br
+
+\fB-q, query\fR [option]
+.br
+    Query the adlists for a specified domain
+.br
+
+    (Query options):
+.br
+      -partial          Search the adlists for partially matching domains
+.br
+      -all              Return all query matches within a adlists
+.br
+
+\fB-h, --help, help\fR
+.br
+    Show a help dialog
+.br
+
+\fB-l, logging\fR [on|off|off noflush]
+.br
+    Specify whether the Pi-hole log should be used
+.br
+
+    (Logging options):
+.br
+      on                Enable the Pi-hole log at /var/log/pihole/pihole.log
+.br
+      off               Disable and flush the Pi-hole log at
+                        /var/log/pihole/pihole.log
+.br
+      off noflush       Disable the Pi-hole log at /var/log/pihole/pihole.log
+.br
+
+\fB-up, updatePihole\fR [--check-only]
+.br
+    Update Pi-hole subsystems
+.br
+
+      --check-only      Exit script before update is performed.
+.br
+
+\fB-v, version\fR
+.br
+    Show installed versions of Pi-hole, Web Interface &amp; FTL
+.br
+
+\fBsetpassword\fR
+.br
+    Set Web Interface password
+.br
+
+\fBuninstall\fR
+.br
+    Uninstall Pi-hole from your system
+.br
+
+\fBstatus\fR
+.br
+    Display the running status of Pi-hole subsystems
+.br
+
+\fBenable\fR [time]
+.br
+    Enable Pi-hole blocking, optionally for a set duration
+.br
+
+\fBdisable\fR [time]
+.br
+    Disable Pi-hole blocking, optionally for a set duration
+.br
+
+    (time options):
+.br
+      #s                Disable Pi-hole functionality for # second(s)
+.br
+      #m                Disable Pi-hole functionality for # minute(s)
+.br
+
+\fBreloaddns\fR
+.br
+    Update the lists and flush the cache without restarting the DNS server
+.br
+
+\fBreloadlists\fR
+.br
+    Update the lists WITHOUT flushing the cache or restarting the DNS server
+.br
+
+\fBcheckout\fR [repo] [branch]
+.br
+    Switch Pi-hole subsystems to a different GitHub branch
+.br
+
+    (repo options):
+.br
+      core              Change the branch of Pi-hole's core subsystem
+.br
+      web               Change the branch of Admin Console subsystem
+.br
+      ftl               Change the branch of Pi-hole's FTL subsystem
+.br
+    (branch options):
+.br
+      master            Update subsystems to the latest stable release
+.br
+      dev               Update subsystems to the latest development
+                        release
+.br
+      branchname        Update subsystems to the specified branchname
+.br
+
+\fBapi\fR endpoint
+.br
+    Query the Pi-hole API at <endpoint>
+.br
+.SH "EXAMPLE"
+
+Some usage examples
+.br
+
+Allow-/denylist manipulation
+.br
+
+\fBpihole allow iloveads.example.com\fR
+.br
+    Allow "iloveads.example.com"
+.br
+
+\fBpihole deny remove noads.example.com\fR
+.br
+    Removes "noads.example.com" from denylist
+.br
+
+\fBpihole --wild example.com\fR
+.br
+    Adds example.com as a wildcard - would block all subdomains of
+    example.com, including example.com itself.
+.br
+
+\fBpihole --regex "ad.*\\.example\\.com$"\fR
+.br
+    Adds "ad.*\\.example\\.com$" to the regex blacklist.
+    Would block all subdomains of example.com which start with "ad"
+.br
+
+Changing the Web Interface password
+.br
+
+\fBpihole setpassword ExamplePassword\fR
+.br
+    Change the password to "ExamplePassword"
+.br
+
+Updating lists from internet sources
+.br
+
+\fBpihole -g\fR
+.br
+    Update the list of ad-serving domains
+.br
+
+Displaying version information
+.br
+
+\fBpihole -v\fR
+.br
+    Display the current version of Pi-hole
+.br
+
+Temporarily disabling Pi-hole
+.br
+
+\fBpihole disable 5m\fR
+.br
+    Disable Pi-hole functionality for five minutes
+.br
+
+Switching Pi-hole subsystem branches
+.br
+
+\fBpihole checkout master\fR
+.br
+    Switch to master branch
+.br
+
+\fBpihole checkout core dev\fR
+.br
+    Switch to core development branch
+.br
+
+\fBpihole arpflush\fR
+.br
+    Flush information stored in Pi-hole's network tables
+.br
+
+\fBpihole api stats/summary\fR
+.br
+    Queries FTL for the stats/summary endpoint
+.br
+
+.SH "COLOPHON"
+
+Get sucked into the latest news and community activity by entering Pi-hole's orbit. Information about Pi-hole, and the latest version of the software can be found at https://pi-hole.net.
+.br

pihole

@@ -0,0 +1,596 @@
+#!/usr/bin/env bash
+
+# Pi-hole: A black hole for Internet advertisements
+# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+# Network-wide ad blocking via your own hardware.
+#
+# Controller for all pihole scripts and functions.
+#
+# This file is copyright under the latest version of the EUPL.
+# Please see LICENSE file for your rights under this license.
+
+readonly PI_HOLE_SCRIPT_DIR="/opt/pihole"
+
+# PI_HOLE_BIN_DIR is not readonly here because in some functions (checkout),
+# they might get set again when the installer is sourced. This causes an
+# error due to modifying a readonly variable.
+PI_HOLE_BIN_DIR="/usr/local/bin"
+
+readonly colfile="${PI_HOLE_SCRIPT_DIR}/COL_TABLE"
+source "${colfile}"
+
+readonly utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
+source "${utilsfile}"
+
+# Source api functions
+readonly apifile="${PI_HOLE_SCRIPT_DIR}/api.sh"
+source "${apifile}"
+
+versionsfile="/etc/pihole/versions"
+if [ -f "${versionsfile}" ]; then
+    # Only source versionsfile if the file exits
+    # fixes a warning during installation where versionsfile does not exist yet
+    # but gravity calls `pihole -status` and thereby sourcing the file
+    source "${versionsfile}"
+fi
+
+# TODO: We can probably remove the reliance on this function too, just tell people to pihole-FTL --config webserver.api.password "password"
+SetWebPassword() {
+    if [ -n "$2" ] ; then
+        readonly PASSWORD="$2"
+        readonly CONFIRM="${PASSWORD}"
+    else
+        # Prevents a bug if the user presses Ctrl+C and it continues to hide the text typed.
+        # So we reset the terminal via stty if the user does press Ctrl+C
+        trap '{ echo -e "\nNot changed" ; stty sane ; exit 1; }' INT
+        read -s -r -p "Enter New Password (Blank for no password): " PASSWORD
+        echo ""
+
+        if [ "${PASSWORD}" == "" ]; then
+            setFTLConfigValue "webserver.api.password" ""
+            echo -e "  ${TICK} Password Removed"
+            exit 0
+        fi
+
+        read -s -r -p "Confirm Password: " CONFIRM
+        echo ""
+    fi
+
+    if [ "${PASSWORD}" == "${CONFIRM}" ] ; then
+        # pihole-FTL will automatically hash the password
+        setFTLConfigValue "webserver.api.password" "${PASSWORD}"
+        echo -e "  ${TICK} New password set"
+    else
+        echo -e "  ${CROSS} Passwords don't match. Your password has not been changed"
+        exit 1
+    fi
+}
+
+listFunc() {
+  "${PI_HOLE_SCRIPT_DIR}"/list.sh "$@"
+  exit 0
+}
+
+debugFunc() {
+    local automated
+    local web
+    local check_database_integrity
+    # Pull off the `debug` leaving passed call augmentation flags in $1
+    shift
+
+    for value in "$@"; do
+        [[ "$value"  == *"-a"* ]] && automated="true"
+        [[ "$value"  == *"-w"* ]] && web="true"
+        [[ "$value"  == *"-c"* ]] && check_database_integrity="true"
+        [[ "$value" == *"--check_database"* ]] && check_database_integrity="true"
+    done
+
+  AUTOMATED=${automated:-} WEBCALL=${web:-} CHECK_DATABASE=${check_database_integrity:-} "${PI_HOLE_SCRIPT_DIR}"/piholeDebug.sh
+  exit 0
+}
+
+flushFunc() {
+  "${PI_HOLE_SCRIPT_DIR}"/piholeLogFlush.sh "$@"
+  exit 0
+}
+
+arpFunc() {
+  "${PI_HOLE_SCRIPT_DIR}"/piholeARPTable.sh "$@"
+  exit 0
+}
+
+updatePiholeFunc() {
+  if [ -n "${DOCKER_VERSION}" ]; then
+    unsupportedFunc
+  else
+    shift
+    "${PI_HOLE_SCRIPT_DIR}"/update.sh "$@"
+    exit 0
+  fi
+}
+
+reconfigurePiholeFunc() {
+  if [ -n "${DOCKER_VERSION}" ]; then
+    unsupportedFunc
+  else
+    /etc/.pihole/automated\ install/basic-install.sh --reconfigure
+    exit 0;
+  fi
+}
+
+updateGravityFunc() {
+  exec "${PI_HOLE_SCRIPT_DIR}"/gravity.sh "$@"
+}
+
+queryFunc() {
+  shift
+  "${PI_HOLE_SCRIPT_DIR}"/query.sh "$@"
+  exit 0
+}
+
+chronometerFunc() {
+  echo "Chronometer is gone, use PADD (https://github.com/pi-hole/PADD)"
+  exit 0
+}
+
+
+uninstallFunc() {
+  if [ -n "${DOCKER_VERSION}" ]; then
+    unsupportedFunc
+  else
+    "${PI_HOLE_SCRIPT_DIR}"/uninstall.sh
+    exit 0
+  fi
+}
+
+versionFunc() {
+  exec "${PI_HOLE_SCRIPT_DIR}"/version.sh
+}
+
+reloadDNS() {
+  local svcOption svc str output status pid icon FTL_PID_FILE
+  svcOption="${1:-reload}"
+
+  # get the current path to the pihole-FTL.pid
+  FTL_PID_FILE="$(getFTLConfigValue files.pid)"
+
+  # Determine if we should reload or restart
+  if [[ "${svcOption}" =~ "reload-lists" ]]; then
+    # Reloading of the lists has been requested
+    # Note 1: This will NOT re-read any *.conf files
+    # Note 2: We cannot use killall here as it does
+    #         not know about real-time signals
+
+    pid="$(getFTLPID ${FTL_PID_FILE})"
+    if [[ "$pid" -eq "-1" ]]; then
+      svc="true"
+      str="FTL is not running"
+      icon="${INFO}"
+    else
+      svc="kill -RTMIN ${pid}"
+      str="Reloading DNS lists"
+      icon="${TICK}"
+    fi
+  elif [[ "${svcOption}" =~ "reload" ]]; then
+    # Reloading of the DNS cache has been requested
+    # Note: This will NOT re-read any *.conf files
+    pid="$(getFTLPID ${FTL_PID_FILE})"
+    if [[ "$pid" -eq "-1" ]]; then
+      svc="true"
+      str="FTL is not running"
+      icon="${INFO}"
+    else
+      svc="kill -HUP ${pid}"
+      str="Flushing DNS cache"
+      icon="${TICK}"
+    fi
+  fi
+
+  # Print output to Terminal, but not to Web Admin
+  [[ -t 1 ]] && echo -ne "  ${INFO} ${str}..."
+
+  output=$( { ${svc}; } 2>&1 )
+  status="$?"
+
+  if [[ "${status}" -eq 0 ]]; then
+    [[ -t 1 ]] && echo -e "${OVER}  ${icon} ${str}"
+    return 0
+  else
+    [[ ! -t 1 ]] && local OVER=""
+    echo -e "${OVER}  ${CROSS} ${output}"
+    return 1
+  fi
+}
+
+piholeEnable() {
+  if [[ "${2}" == "-h" ]] || [[ "${2}" == "--help" ]]; then
+    echo "Usage: pihole enable/disable [time]
+Example: 'pihole enable', or 'pihole disable 5m'
+En- or disable Pi-hole subsystems
+
+Time:
+  #s               En-/disable Pi-hole functionality for # second(s)
+  #m               En-/disable Pi-hole functionality for # minute(s)"
+    exit 0
+
+  fi
+
+  # Get timer
+  local tt="null"
+  if [[ $# -gt 1 ]]; then
+    local error=false
+    if [[ "${2}" == *"s" ]]; then
+      tt=${2%"s"}
+      if [[ ! "${tt}" =~ ^-?[0-9]+$ ]];then
+        local error=true
+      fi
+    elif [[ "${2}" == *"m" ]]; then
+      tt=${2%"m"}
+      if [[ "${tt}" =~ ^-?[0-9]+$ ]];then
+        tt=$((${tt}*60))
+      else
+        local error=true
+      fi
+    elif [[ -n "${2}" ]]; then
+      local error=true
+    fi
+
+    if [[ ${error} == true ]];then
+      echo -e "  ${COL_LIGHT_RED}Unknown format for blocking timer!${COL_NC}"
+      echo -e "  Try 'pihole disable --help' for more information."
+      exit 1
+    fi
+  fi
+
+  # Authenticate with the API
+  LoginAPI
+
+  # Send the request
+  data=$(PostFTLData "dns/blocking" "{ \"blocking\": ${1}, \"timer\": ${tt} }")
+
+  # Check the response
+  local extra=" forever"
+  local timer="$(echo "${data}"| jq --raw-output '.timer' )"
+  if [[ "${timer}" != "null" ]]; then
+    extra=" for ${timer}s"
+  fi
+  local str="Pi-hole $(echo "${data}" | jq --raw-output '.blocking')${extra}"
+
+  # Logout from the API
+  LogoutAPI
+
+  echo -e "${OVER}  ${TICK} ${str}"
+}
+
+piholeLogging() {
+  shift
+  if [[ "${1}" == "-h" ]] || [[ "${1}" == "--help" ]]; then
+    echo "Usage: pihole logging [options]
+Example: 'pihole logging on'
+Specify whether the Pi-hole log should be used
+
+Options:
+  on                  Enable the Pi-hole log at /var/log/pihole/pihole.log
+  off                 Disable and flush the Pi-hole log at /var/log/pihole/pihole.log
+  off noflush         Disable the Pi-hole log at /var/log/pihole/pihole.log"
+    exit 0
+  elif [[ "${1}" == "off" ]]; then
+    # Disable logging
+    setFTLConfigValue dns.queryLogging false
+    if [[ "${2}" != "noflush" ]]; then
+      # Flush logs
+      "${PI_HOLE_BIN_DIR}"/pihole -f
+    fi
+    echo -e "  ${INFO} Disabling logging..."
+    local str="Logging has been disabled!"
+  elif [[ "${1}" == "on" ]]; then
+    # Enable logging
+    setFTLConfigValue dns.queryLogging true
+    echo -e "  ${INFO} Enabling logging..."
+    local str="Logging has been enabled!"
+  else
+    echo -e "  ${COL_LIGHT_RED}Invalid option${COL_NC}
+  Try 'pihole logging --help' for more information."
+    exit 1
+  fi
+  echo -e "${OVER}  ${TICK} ${str}"
+}
+
+analyze_ports() {
+  local lv4 lv6 port=${1}
+  # FTL is listening at least on at least one port when this
+  # function is getting called
+  # Check individual address family/protocol combinations
+  # For a healthy Pi-hole, they should all be up (nothing printed)
+  lv4="$(ss --ipv4 --listening --numeric --tcp --udp src :${port})"
+  if grep -q "udp " <<< "${lv4}"; then
+      echo -e "     ${TICK} UDP (IPv4)"
+  else
+      echo -e "     ${CROSS} UDP (IPv4)"
+  fi
+  if grep -q "tcp " <<< "${lv4}"; then
+      echo -e "     ${TICK} TCP (IPv4)"
+  else
+      echo -e "     ${CROSS} TCP (IPv4)"
+  fi
+  lv6="$(ss --ipv6 --listening --numeric --tcp --udp src :${port})"
+  if grep -q "udp " <<< "${lv6}"; then
+      echo -e "     ${TICK} UDP (IPv6)"
+  else
+      echo -e "     ${CROSS} UDP (IPv6)"
+  fi
+  if grep -q "tcp " <<< "${lv6}"; then
+      echo -e "     ${TICK} TCP (IPv6)"
+  else
+      echo -e "     ${CROSS} TCP (IPv6)"
+  fi
+  echo ""
+}
+
+statusFunc() {
+    # Determine if there is pihole-FTL service is listening
+    local pid port ftl_pid_file block_status
+
+    ftl_pid_file="$(getFTLConfigValue files.pid)"
+
+    pid="$(getFTLPID ${ftl_pid_file})"
+
+    if [[ "$pid" -eq "-1" ]]; then
+        case "${1}" in
+            "web") echo "-1";;
+            *) echo -e "  ${CROSS} DNS service is NOT running";;
+        esac
+        exit 0
+    else
+        # get the DNS port pihole-FTL is listening on
+        port="$(getFTLConfigValue dns.port)"
+        if [[ "${port}" == "0" ]]; then
+            case "${1}" in
+                "web") echo "-1";;
+                *) echo -e "  ${CROSS} DNS service is NOT listening";;
+            esac
+            exit 0
+        else
+            if [[ "${1}" != "web" ]]; then
+                echo -e "  ${TICK} FTL is listening on port ${port}"
+                analyze_ports "${port}"
+            fi
+        fi
+    fi
+
+  # Determine if Pi-hole's blocking is enabled
+  block_status=$(getFTLConfigValue dns.blocking.active)
+  if [ ${block_status} == "true" ]; then
+    case "${1}" in
+      "web") echo "$port";;
+      *) echo -e "  ${TICK} Pi-hole blocking is enabled";;
+    esac
+  else
+    case "${1}" in
+      "web") echo 0;;
+      *) echo -e "  ${CROSS} Pi-hole blocking is disabled";;
+    esac
+  fi
+
+  exit 0
+}
+
+tailFunc() {
+  # Warn user if Pi-hole's logging is disabled
+  local logging_enabled=$(getFTLConfigValue dns.queryLogging)
+  if [[ "${logging_enabled}" != "true" ]]; then
+    echo "  ${CROSS} Warning: Query logging is disabled"
+  fi
+  echo -e "  ${INFO} Press Ctrl-C to exit"
+
+  # Get logfile path
+  readonly LOGFILE=$(getFTLConfigValue files.log.dnsmasq)
+
+  # Strip date from each line
+  # Color blocklist/denylist/wildcard entries as red
+  # Color A/AAAA/DHCP strings as white
+  # Color everything else as gray
+  tail -f $LOGFILE | grep --line-buffered "${1}" | sed -E \
+    -e "s,($(date +'%b %d ')| dnsmasq\[[0-9]*\]),,g" \
+    -e "s,(.*(denied |gravity blocked ).*),${COL_RED}&${COL_NC}," \
+    -e "s,.*(query\\[A|DHCP).*,${COL_NC}&${COL_NC}," \
+    -e "s,.*,${COL_GRAY}&${COL_NC},"
+  exit 0
+}
+
+piholeCheckoutFunc() {
+  if [ -n "${DOCKER_VERSION}" ]; then
+    unsupportedFunc
+  else
+    if [[ "$2" == "-h" ]] || [[ "$2" == "--help" ]]; then
+      echo "Switch Pi-hole subsystems to a different GitHub branch
+    Usage: ${COL_GREEN}pihole checkout${COL_NC} ${COL_YELLOW}shortcut${COL_NC}
+        or ${COL_GREEN}pihole checkout${COL_NC} ${COL_PURPLE}repo${COL_NC} ${COL_CYAN}branch${COL_NC}
+
+  Example: ${COL_GREEN}pihole checkout${COL_NC} ${COL_YELLOW}master${COL_NC}
+       or  ${COL_GREEN}pihole checkout${COL_NC} ${COL_PURPLE}ftl ${COL_CYAN}development${COL_NC}
+
+  Shortcuts:
+    ${COL_YELLOW}master${COL_NC}            Update all subsystems to the latest stable release
+    ${COL_YELLOW}dev${COL_NC}               Update all subsystems to the latest development release
+
+  Individual components:
+    ${COL_PURPLE}core${COL_NC} ${COL_CYAN}branch${COL_NC}       Change the branch of Pi-hole's core subsystem
+    ${COL_PURPLE}web${COL_NC} ${COL_CYAN}branch${COL_NC}        Change the branch of the web interface subsystem
+    ${COL_PURPLE}ftl${COL_NC} ${COL_CYAN}branch${COL_NC}        Change the branch of Pi-hole's FTL subsystem"
+
+      exit 0
+    fi
+
+    source "${PI_HOLE_SCRIPT_DIR}"/piholeCheckout.sh
+    shift
+    checkout "$@"
+  fi
+}
+
+tricorderFunc() {
+  local tricorder_token
+  if [[ ! -p "/dev/stdin" ]]; then
+    echo -e "  ${INFO} Please do not call Tricorder directly"
+    exit 1
+  fi
+
+  tricorder_token=$(curl --silent --fail --show-error --upload-file "-" https://tricorder.pi-hole.net/upload < /dev/stdin 2>&1)
+  if [[ "${tricorder_token}" != "https://tricorder.pi-hole.net/"* ]]; then
+      echo -e "${CROSS} uploading failed, contact Pi-hole support for assistance."
+      # Log curl error (if available)
+      if [ -n "${tricorder_token}" ]; then
+          echo -e "${INFO} Error message: ${COL_RED}${tricorder_token}${COL_NC}\\n"
+          tricorder_token=""
+      fi
+      exit 1
+  fi
+  echo "Upload successful, your token is: ${COL_GREEN}${tricorder_token}${COL_NC}"
+  exit 0
+}
+
+updateCheckFunc() {
+  "${PI_HOLE_SCRIPT_DIR}"/updatecheck.sh "$@"
+  exit 0
+}
+
+unsupportedFunc(){
+  echo "Function not supported in Docker images"
+  exit 0
+}
+
+helpFunc() {
+  echo "Usage: pihole [options]
+Example: 'pihole allow -h'
+Add '-h' after specific commands for more information on usage
+
+Domain Options:
+  allow, allowlist    Allow domain(s)
+  deny, denylist      Deny domain(s)
+  --regex, regex      Regex deny domains(s)
+  --allow-regex       Regex allow domains(s)
+  --wild, wildcard    Wildcard deny domain(s)
+  --allow-wild        Wildcard allow domain(s)
+                        Add '-h' for more info on allow/deny usage
+
+Debugging Options:
+  -d, debug           Start a debugging session
+                        Add '-c' or '--check-database' to include a Pi-hole database integrity check
+                        Add '-a' to automatically upload the log to tricorder.pi-hole.net
+  -f, flush           Flush the Pi-hole log
+  -r, reconfigure     Reconfigure or Repair Pi-hole subsystems
+  -t, tail [arg]      View the live output of the Pi-hole log.
+                      Add an optional argument to filter the log
+                      (regular expressions are supported)
+  api <endpoint>      Query the Pi-hole API at <endpoint>
+
+
+Options:
+  setpassword [pwd]   Set the password for the web interface
+                        Without optional argument, password is read interactively.
+                        When specifying a password directly, enclose it in single quotes.
+  -g, updateGravity   Update the list of ad-serving domains
+  -h, --help, help    Show this help dialog
+  -l, logging         Specify whether the Pi-hole log should be used
+                        Add '-h' for more info on logging usage
+  -q, query           Query the adlists for a specified domain
+                        Add '-h' for more info on query usage
+  -up, updatePihole   Update Pi-hole subsystems
+                        Add '--check-only' to exit script before update is performed.
+  -v, version         Show installed versions of Pi-hole, Web Interface & FTL
+  uninstall           Uninstall Pi-hole from your system
+  status              Display the running status of Pi-hole subsystems
+  enable              Enable Pi-hole subsystems
+                        Add '-h' for more info on enable usage
+  disable             Disable Pi-hole subsystems
+                        Add '-h' for more info on disable usage
+  reloaddns           Update the lists and flush the cache without restarting the DNS server
+  reloadlists         Update the lists WITHOUT flushing the cache or restarting the DNS server
+  checkout            Switch Pi-hole subsystems to a different GitHub branch
+                        Add '-h' for more info on checkout usage
+  arpflush            Flush information stored in Pi-hole's network tables";
+  exit 0
+}
+
+if [[ $# = 0 ]]; then
+  helpFunc
+fi
+
+# functions that do not require sudo power
+need_root=1
+case "${1}" in
+  "-h" | "help" | "--help"        ) helpFunc;;
+  "-v" | "version"                ) versionFunc;;
+  "-c" | "chronometer"            ) chronometerFunc "$@";;
+  "-q" | "query"                  ) queryFunc "$@";;
+  "status"                        ) statusFunc "$2";;
+  "tricorder"                     ) tricorderFunc;;
+
+  # we need to add all arguments that require sudo power to not trigger the * argument
+  "allow" | "allowlist"           ) need_root=0;;
+  "deny" | "denylist"             ) need_root=0;;
+  "--wild" | "wildcard"           ) need_root=0;;
+  "--regex" | "regex"             ) need_root=0;;
+  "--allow-regex" | "allow-regex" ) need_root=0;;
+  "--allow-wild" | "allow-wild"   ) need_root=0;;
+  "-f" | "flush"                  ) ;;
+  "-up" | "updatePihole"          ) ;;
+  "-r"  | "reconfigure"           ) ;;
+  "-l" | "logging"                ) ;;
+  "uninstall"                     ) ;;
+  "enable"                        ) need_root=0;;
+  "disable"                       ) need_root=0;;
+  "-d" | "debug"                  ) ;;
+  "-g" | "updateGravity"          ) ;;
+  "reloaddns"                     ) ;;
+  "reloadlists"                   ) ;;
+  "setpassword"                   ) ;;
+  "checkout"                      ) ;;
+  "updatechecker"                 ) ;;
+  "arpflush"                      ) ;;
+  "-t" | "tail"                   ) ;;
+  "api"                           ) need_root=0;;
+  *                               ) helpFunc;;
+esac
+
+# In the case of alpine running in a container, the USER variable appears to be blank
+# which prevents the next trap from working correctly. Set it by running whoami
+if [[ -z ${USER} ]]; then
+  USER=$(whoami)
+fi
+
+# Check if the current user is neither root nor pihole and if the command
+# requires root. If so, exit with an error message.
+if [[ $EUID -ne 0 && ${USER} != "pihole" && need_root -eq 1 ]];then
+  echo -e "  ${CROSS} The Pi-hole command requires root privileges, try:"
+  echo -e "      ${COL_GREEN}sudo pihole $*${COL_NC}"
+  exit 1
+fi
+
+# Handle redirecting to specific functions based on arguments
+case "${1}" in
+  "allow" | "allowlist"           ) listFunc "$@";;
+  "deny" | "denylist"             ) listFunc "$@";;
+  "--wild" | "wildcard"           ) listFunc "$@";;
+  "--regex" | "regex"             ) listFunc "$@";;
+  "--allow-regex" | "allow-regex" ) listFunc "$@";;
+  "--allow-wild" | "allow-wild"   ) listFunc "$@";;
+  "-d" | "debug"                  ) debugFunc "$@";;
+  "-f" | "flush"                  ) flushFunc "$@";;
+  "-up" | "updatePihole"          ) updatePiholeFunc "$@";;
+  "-r"  | "reconfigure"           ) reconfigurePiholeFunc;;
+  "-g" | "updateGravity"          ) updateGravityFunc "$@";;
+  "-l" | "logging"                ) piholeLogging "$@";;
+  "uninstall"                     ) uninstallFunc;;
+  "enable"                        ) piholeEnable true "$2";;
+  "disable"                       ) piholeEnable false "$2";;
+  "reloaddns"                     ) reloadDNS "reload";;
+  "reloadlists"                   ) reloadDNS "reload-lists";;
+  "setpassword"                   ) SetWebPassword "$@";;
+  "checkout"                      ) piholeCheckoutFunc "$@";;
+  "updatechecker"                 ) shift; updateCheckFunc "$@";;
+  "arpflush"                      ) arpFunc "$@";;
+  "-t" | "tail"                   ) tailFunc "$2";;
+  "api"                           ) apiFunc "$2";;
+  *                               ) helpFunc;;
+esac

test/README.md

@@ -0,0 +1,25 @@
+# Recommended way to run tests
+
+Make sure you have Docker and Python w/pip package manager.
+
+From command line all you need to do is:
+
+- `pip install tox`
+- `tox`
+
+Tox handles setting up a virtual environment for python dependencies, installing dependencies, building the docker images used by tests, and finally running tests.  It's an easy way to have travis-ci like build behavior locally.
+
+## Alternative py.test method of running tests
+
+You're responsible for setting up your virtual env and dependencies in this situation.
+
+```
+py.test -vv -n auto -m "build_stage"
+py.test -vv -n auto -m "not build_stage"
+```
+
+The build_stage tests have to run first to create the docker images, followed by the actual tests which utilize said images. Unless you're changing your dockerfiles you shouldn't have to run the build_stage every time - but it's a good idea to rebuild at least once a day in case the base Docker images or packages change.
+
+# How do I debug python?
+
+Highly recommended: Setup PyCharm on a **Docker enabled** machine. Having a python debugger like PyCharm changes your life if you've never used it :)

test/_centos_9.Dockerfile

@@ -0,0 +1,20 @@
+FROM quay.io/centos/centos:stream9
+# Disable SELinux
+RUN echo "SELINUX=disabled" > /etc/selinux/config
+RUN yum install -y --allowerasing curl git initscripts
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_debian_11.Dockerfile

@@ -0,0 +1,17 @@
+FROM buildpack-deps:bullseye-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_debian_12.Dockerfile

@@ -0,0 +1,17 @@
+FROM buildpack-deps:bookworm-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_fedora_40.Dockerfile

@@ -0,0 +1,18 @@
+FROM fedora:40
+RUN dnf install -y git initscripts
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_fedora_41.Dockerfile

@@ -0,0 +1,18 @@
+FROM fedora:41
+RUN dnf install -y git initscripts
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_ubuntu_20.Dockerfile

@@ -0,0 +1,17 @@
+FROM buildpack-deps:focal-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_ubuntu_22.Dockerfile

@@ -0,0 +1,18 @@
+FROM buildpack-deps:jammy-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_ubuntu_23.Dockerfile

@@ -0,0 +1,18 @@
+FROM buildpack-deps:lunar-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/_ubuntu_24.Dockerfile

@@ -0,0 +1,18 @@
+FROM buildpack-deps:24.04-scm
+
+ENV GITDIR=/etc/.pihole
+ENV SCRIPTDIR=/opt/pihole
+
+RUN mkdir -p $GITDIR $SCRIPTDIR /etc/pihole
+ADD . $GITDIR
+RUN cp $GITDIR/advanced/Scripts/*.sh $GITDIR/gravity.sh $GITDIR/pihole $GITDIR/automated\ install/*.sh $GITDIR/advanced/Scripts/COL_TABLE $SCRIPTDIR/
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$SCRIPTDIR
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN true && \
+    chmod +x $SCRIPTDIR/*
+
+ENV SKIP_INSTALL=true
+ENV OS_CHECK_DOMAIN_NAME=dev-supportedos.pi-hole.net
+
+#sed '/# Start the installer/Q' /opt/pihole/basic-install.sh > /opt/pihole/stub_basic-install.sh && \

test/conftest.py

@@ -0,0 +1,219 @@
+import pytest
+import testinfra
+import testinfra.backend.docker
+import subprocess
+from textwrap import dedent
+
+IMAGE = "pytest_pihole:test_container"
+tick_box = "[✓]"
+cross_box = "[✗]"
+info_box = "[i]"
+
+
+# Monkeypatch sh to bash, if they ever support non hard code /bin/sh this can go away
+# https://github.com/pytest-dev/pytest-testinfra/blob/master/testinfra/backend/docker.py
+def run_bash(self, command, *args, **kwargs):
+    cmd = self.get_command(command, *args)
+    if self.user is not None:
+        out = self.run_local(
+            "docker exec -u %s %s /bin/bash -c %s", self.user, self.name, cmd
+        )
+    else:
+        out = self.run_local("docker exec %s /bin/bash -c %s", self.name, cmd)
+    out.command = self.encode(cmd)
+    return out
+
+
+testinfra.backend.docker.DockerBackend.run = run_bash
+
+
+@pytest.fixture
+def host():
+    # run a container
+    docker_id = (
+        subprocess.check_output(["docker", "run", "-t", "-d", "--cap-add=ALL", IMAGE])
+        .decode()
+        .strip()
+    )
+
+    # return a testinfra connection to the container
+    docker_host = testinfra.get_host("docker://" + docker_id)
+
+    yield docker_host
+    # at the end of the test suite, destroy the container
+    subprocess.check_call(["docker", "rm", "-f", docker_id])
+
+
+# Helper functions
+def mock_command(script, args, container):
+    """
+    Allows for setup of commands we don't really want to have to run for real
+    in unit tests
+    """
+    full_script_path = "/usr/local/bin/{}".format(script)
+    mock_script = dedent(
+        r"""\
+    #!/bin/bash -e
+    echo "\$0 \$@" >> /var/log/{script}
+    case "\$1" in""".format(
+            script=script
+        )
+    )
+    for k, v in args.items():
+        case = dedent(
+            """
+        {arg})
+        echo {res}
+        exit {retcode}
+        ;;""".format(
+                arg=k, res=v[0], retcode=v[1]
+            )
+        )
+        mock_script += case
+    mock_script += dedent(
+        """
+    esac"""
+    )
+    container.run(
+        """
+    cat <<EOF> {script}\n{content}\nEOF
+    chmod +x {script}
+    rm -f /var/log/{scriptlog}""".format(
+            script=full_script_path, content=mock_script, scriptlog=script
+        )
+    )
+
+
+def mock_command_passthrough(script, args, container):
+    """
+    Per other mock_command* functions, allows intercepting of commands we don't want to run for real
+    in unit tests, however also allows only specific arguments to be mocked. Anything not defined will
+    be passed through to the actual command.
+
+    Example use-case: mocking `git pull` but still allowing `git clone` to work as intended
+    """
+    orig_script_path = container.check_output("command -v {}".format(script))
+    full_script_path = "/usr/local/bin/{}".format(script)
+    mock_script = dedent(
+        r"""\
+    #!/bin/bash -e
+    echo "\$0 \$@" >> /var/log/{script}
+    case "\$1" in""".format(
+            script=script
+        )
+    )
+    for k, v in args.items():
+        case = dedent(
+            """
+        {arg})
+        echo {res}
+        exit {retcode}
+        ;;""".format(
+                arg=k, res=v[0], retcode=v[1]
+            )
+        )
+        mock_script += case
+    mock_script += dedent(
+        r"""
+    *)
+    {orig_script_path} "\$@"
+    ;;""".format(
+            orig_script_path=orig_script_path
+        )
+    )
+    mock_script += dedent(
+        """
+    esac"""
+    )
+    container.run(
+        """
+    cat <<EOF> {script}\n{content}\nEOF
+    chmod +x {script}
+    rm -f /var/log/{scriptlog}""".format(
+            script=full_script_path, content=mock_script, scriptlog=script
+        )
+    )
+
+
+def mock_command_run(script, args, container):
+    """
+    Allows for setup of commands we don't really want to have to run for real
+    in unit tests
+    """
+    full_script_path = "/usr/local/bin/{}".format(script)
+    mock_script = dedent(
+        r"""\
+    #!/bin/bash -e
+    echo "\$0 \$@" >> /var/log/{script}
+    case "\$1 \$2" in""".format(
+            script=script
+        )
+    )
+    for k, v in args.items():
+        case = dedent(
+            """
+        \"{arg}\")
+        echo {res}
+        exit {retcode}
+        ;;""".format(
+                arg=k, res=v[0], retcode=v[1]
+            )
+        )
+        mock_script += case
+    mock_script += dedent(
+        """
+    esac"""
+    )
+    container.run(
+        """
+    cat <<EOF> {script}\n{content}\nEOF
+    chmod +x {script}
+    rm -f /var/log/{scriptlog}""".format(
+            script=full_script_path, content=mock_script, scriptlog=script
+        )
+    )
+
+
+def mock_command_2(script, args, container):
+    """
+    Allows for setup of commands we don't really want to have to run for real
+    in unit tests
+    """
+    full_script_path = "/usr/local/bin/{}".format(script)
+    mock_script = dedent(
+        r"""\
+    #!/bin/bash -e
+    echo "\$0 \$@" >> /var/log/{script}
+    case "\$1 \$2" in""".format(
+            script=script
+        )
+    )
+    for k, v in args.items():
+        case = dedent(
+            """
+        \"{arg}\")
+        echo \"{res}\"
+        exit {retcode}
+        ;;""".format(
+                arg=k, res=v[0], retcode=v[1]
+            )
+        )
+        mock_script += case
+    mock_script += dedent(
+        """
+    esac"""
+    )
+    container.run(
+        """
+    cat <<EOF> {script}\n{content}\nEOF
+    chmod +x {script}
+    rm -f /var/log/{scriptlog}""".format(
+            script=full_script_path, content=mock_script, scriptlog=script
+        )
+    )
+
+
+def run_script(Pihole, script):
+    result = Pihole.run(script)
+    assert result.rc == 0
+    return result

test/requirements.txt

@@ -0,0 +1,6 @@
+pyyaml == 6.0.2
+pytest == 8.3.4
+pytest-xdist == 3.6.1
+pytest-testinfra == 10.1.1
+tox == 4.23.2
+pytest-clarity == 1.0.1

test/setup.py

@@ -0,0 +1,7 @@
+from setuptools import setup
+
+setup(
+    py_modules=[],
+    setup_requires=["pytest-runner"],
+    tests_require=["pytest"],
+)

test/test_any_automated_install.py

@@ -0,0 +1,556 @@
+import pytest
+from textwrap import dedent
+import re
+from .conftest import (
+    tick_box,
+    info_box,
+    cross_box,
+    mock_command,
+    mock_command_run,
+    mock_command_2,
+    mock_command_passthrough,
+    run_script,
+)
+
+FTL_BRANCH = "development"
+
+
+def test_supported_package_manager(host):
+    """
+    confirm installer exits when no supported package manager found
+    """
+    # break supported package managers
+    host.run("rm -rf /usr/bin/apt-get")
+    host.run("rm -rf /usr/bin/rpm")
+    package_manager_detect = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    """
+    )
+    expected_stdout = cross_box + " No supported package manager found"
+    assert expected_stdout in package_manager_detect.stdout
+    # assert package_manager_detect.rc == 1
+
+
+def test_selinux_not_detected(host):
+    """
+    confirms installer continues when SELinux configuration file does not exist
+    """
+    check_selinux = host.run(
+        """
+    rm -f /etc/selinux/config
+    source /opt/pihole/basic-install.sh
+    checkSelinux
+    """
+    )
+    expected_stdout = info_box + " SELinux not detected"
+    assert expected_stdout in check_selinux.stdout
+    assert check_selinux.rc == 0
+
+
+def get_directories_recursive(host, directory):
+    if directory is None:
+        return directory
+    # returns all non-hidden subdirs of 'directory'
+    dirs_raw = host.run("find {} -type d -not -path '*/.*'".format(directory))
+    dirs = list(filter(bool, dirs_raw.stdout.splitlines()))
+    return dirs
+
+
+def test_installPihole_fresh_install_readableFiles(host):
+    """
+    confirms all necessary files are readable by pihole user
+    """
+    # dialog returns Cancel for user prompt
+    mock_command("dialog", {"*": ("", "0")}, host)
+    # mock git pull
+    mock_command_passthrough("git", {"pull": ("", "0")}, host)
+    # mock systemctl to not start FTL
+    mock_command_2(
+        "systemctl",
+        {
+            "enable pihole-FTL": ("", "0"),
+            "restart pihole-FTL": ("", "0"),
+            "start pihole-FTL": ("", "0"),
+            "*": ('echo "systemctl call with $@"', "0"),
+        },
+        host,
+    )
+    # try to install man
+    host.run("command -v apt-get > /dev/null && apt-get install -qq man")
+    host.run("command -v dnf > /dev/null && dnf install -y man")
+    host.run("command -v yum > /dev/null && yum install -y man")
+    # Workaround to get FTLv6 installed until it reaches master branch
+    host.run('echo "' + FTL_BRANCH + '" > /etc/pihole/ftlbranch')
+    install = host.run(
+        """
+    export TERM=xterm
+    export DEBIAN_FRONTEND=noninteractive
+    umask 0027
+    runUnattended=true
+    useUpdateVars=true
+    source /opt/pihole/basic-install.sh > /dev/null
+    runUnattended=true
+    useUpdateVars=true
+    main
+    /opt/pihole/pihole-FTL-prestart.sh
+    """
+    )
+    assert 0 == install.rc
+    maninstalled = True
+    if (info_box + " man not installed") in install.stdout:
+        maninstalled = False
+    if (info_box + " man pages not installed") in install.stdout:
+        maninstalled = False
+    piholeuser = "pihole"
+    exit_status_success = 0
+    test_cmd = 'su --shell /bin/bash --command "test -{0} {1}" -p {2}'
+    # check files in /etc/pihole for read, write and execute permission
+    check_etc = test_cmd.format("r", "/etc/pihole", piholeuser)
+    actual_rc = host.run(check_etc).rc
+    assert exit_status_success == actual_rc
+    check_etc = test_cmd.format("x", "/etc/pihole", piholeuser)
+    actual_rc = host.run(check_etc).rc
+    assert exit_status_success == actual_rc
+    # readable and writable dhcp.leases
+    check_leases = test_cmd.format("r", "/etc/pihole/dhcp.leases", piholeuser)
+    actual_rc = host.run(check_leases).rc
+    assert exit_status_success == actual_rc
+    check_leases = test_cmd.format("w", "/etc/pihole/dhcp.leases", piholeuser)
+    actual_rc = host.run(check_leases).rc
+    # readable dns-servers.conf
+    assert exit_status_success == actual_rc
+    check_servers = test_cmd.format("r", "/etc/pihole/dns-servers.conf", piholeuser)
+    actual_rc = host.run(check_servers).rc
+    assert exit_status_success == actual_rc
+    # readable install.log
+    check_install = test_cmd.format("r", "/etc/pihole/install.log", piholeuser)
+    actual_rc = host.run(check_install).rc
+    assert exit_status_success == actual_rc
+    # readable versions
+    check_localversion = test_cmd.format("r", "/etc/pihole/versions", piholeuser)
+    actual_rc = host.run(check_localversion).rc
+    assert exit_status_success == actual_rc
+    # readable logrotate
+    check_logrotate = test_cmd.format("r", "/etc/pihole/logrotate", piholeuser)
+    actual_rc = host.run(check_logrotate).rc
+    assert exit_status_success == actual_rc
+    # readable macvendor.db
+    check_macvendor = test_cmd.format("r", "/etc/pihole/macvendor.db", piholeuser)
+    actual_rc = host.run(check_macvendor).rc
+    assert exit_status_success == actual_rc
+    # check readable and executable /etc/init.d/pihole-FTL
+    check_init = test_cmd.format("x", "/etc/init.d/pihole-FTL", piholeuser)
+    actual_rc = host.run(check_init).rc
+    assert exit_status_success == actual_rc
+    check_init = test_cmd.format("r", "/etc/init.d/pihole-FTL", piholeuser)
+    actual_rc = host.run(check_init).rc
+    assert exit_status_success == actual_rc
+    # check readable and executable manpages
+    if maninstalled is True:
+        check_man = test_cmd.format("x", "/usr/local/share/man", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format("r", "/usr/local/share/man", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format("x", "/usr/local/share/man/man8", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format("r", "/usr/local/share/man/man8", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format("x", "/usr/local/share/man/man5", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format("r", "/usr/local/share/man/man5", piholeuser)
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+        check_man = test_cmd.format(
+            "r", "/usr/local/share/man/man8/pihole.8", piholeuser
+        )
+        actual_rc = host.run(check_man).rc
+        assert exit_status_success == actual_rc
+    # check not readable cron file
+    check_sudo = test_cmd.format("x", "/etc/cron.d/", piholeuser)
+    actual_rc = host.run(check_sudo).rc
+    assert exit_status_success == actual_rc
+    check_sudo = test_cmd.format("r", "/etc/cron.d/", piholeuser)
+    actual_rc = host.run(check_sudo).rc
+    assert exit_status_success == actual_rc
+    check_sudo = test_cmd.format("r", "/etc/cron.d/pihole", piholeuser)
+    actual_rc = host.run(check_sudo).rc
+    assert exit_status_success == actual_rc
+    directories = get_directories_recursive(host, "/etc/.pihole/")
+    for directory in directories:
+        check_pihole = test_cmd.format("r", directory, piholeuser)
+        actual_rc = host.run(check_pihole).rc
+        check_pihole = test_cmd.format("x", directory, piholeuser)
+        actual_rc = host.run(check_pihole).rc
+        findfiles = 'find "{}" -maxdepth 1 -type f  -exec echo {{}} \\;;'
+        filelist = host.run(findfiles.format(directory))
+        files = list(filter(bool, filelist.stdout.splitlines()))
+        for file in files:
+            check_pihole = test_cmd.format("r", file, piholeuser)
+            actual_rc = host.run(check_pihole).rc
+
+
+def test_update_package_cache_success_no_errors(host):
+    """
+    confirms package cache was updated without any errors
+    """
+    updateCache = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    update_package_cache
+    """
+    )
+    expected_stdout = tick_box + " Update local cache of available packages"
+    assert expected_stdout in updateCache.stdout
+    assert "error" not in updateCache.stdout.lower()
+
+
+def test_update_package_cache_failure_no_errors(host):
+    """
+    confirms package cache was not updated
+    """
+    mock_command("apt-get", {"update": ("", "1")}, host)
+    updateCache = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    update_package_cache
+    """
+    )
+    expected_stdout = cross_box + " Update local cache of available packages"
+    assert expected_stdout in updateCache.stdout
+    assert "Error: Unable to update package cache." in updateCache.stdout
+
+
+@pytest.mark.parametrize(
+    "arch,detected_string,supported",
+    [
+        ("aarch64", "AArch64 (64 Bit ARM)", True),
+        ("armv6", "ARMv6", True),
+        ("armv7l", "ARMv7 (or newer)", True),
+        ("armv7", "ARMv7 (or newer)", True),
+        ("armv8a", "ARMv7 (or newer)", True),
+        ("x86_64", "x86_64", True),
+        ("riscv64", "riscv64", True),
+        ("mips", "mips", False),
+    ],
+)
+def test_FTL_detect_no_errors(host, arch, detected_string, supported):
+    """
+    confirms only correct package is downloaded for FTL engine
+    """
+    # mock uname to return passed platform
+    mock_command("uname", {"-m": (arch, "0")}, host)
+    # mock readelf to respond with passed CPU architecture
+    mock_command_2(
+        "readelf",
+        {
+            "-A /bin/sh": ("Tag_CPU_arch: " + arch, "0"),
+            "-A /usr/bin/sh": ("Tag_CPU_arch: " + arch, "0"),
+        },
+        host,
+    )
+    host.run('echo "' + FTL_BRANCH + '" > /etc/pihole/ftlbranch')
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    create_pihole_user
+    funcOutput=$(get_binary_name)
+    binary="pihole-FTL${funcOutput##*pihole-FTL}"
+    theRest="${funcOutput%pihole-FTL*}"
+    FTLdetect "${binary}" "${theRest}"
+    """
+    )
+    if supported:
+        expected_stdout = info_box + " FTL Checks..."
+        assert expected_stdout in detectPlatform.stdout
+        expected_stdout = tick_box + " Detected " + detected_string + " architecture"
+        assert expected_stdout in detectPlatform.stdout
+        expected_stdout = tick_box + " Downloading and Installing FTL"
+        assert expected_stdout in detectPlatform.stdout
+    else:
+        expected_stdout = (
+            "Not able to detect architecture (unknown: " + detected_string + ")"
+        )
+        assert expected_stdout in detectPlatform.stdout
+
+
+def test_FTL_development_binary_installed_and_responsive_no_errors(host):
+    """
+    confirms FTL development binary is copied and functional in installed location
+    """
+    host.run('echo "' + FTL_BRANCH + '" > /etc/pihole/ftlbranch')
+    host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    create_pihole_user
+    funcOutput=$(get_binary_name)
+    binary="pihole-FTL${funcOutput##*pihole-FTL}"
+    theRest="${funcOutput%pihole-FTL*}"
+    FTLdetect "${binary}" "${theRest}"
+    """
+    )
+    version_check = host.run(
+        """
+    VERSION=$(pihole-FTL version)
+    echo ${VERSION:0:1}
+    """
+    )
+    expected_stdout = "v"
+    assert expected_stdout in version_check.stdout
+
+
+def test_IPv6_only_link_local(host):
+    """
+    confirms IPv6 blocking is disabled for Link-local address
+    """
+    # mock ip -6 address to return Link-local address
+    mock_command_2(
+        "ip",
+        {"-6 address": ("inet6 fe80::d210:52fa:fe00:7ad7/64 scope link", "0")},
+        host,
+    )
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    find_IPv6_information
+    """
+    )
+    expected_stdout = "Unable to find IPv6 ULA/GUA address"
+    assert expected_stdout in detectPlatform.stdout
+
+
+def test_IPv6_only_ULA(host):
+    """
+    confirms IPv6 blocking is enabled for ULA addresses
+    """
+    # mock ip -6 address to return ULA address
+    mock_command_2(
+        "ip",
+        {
+            "-6 address": (
+                "inet6 fda2:2001:5555:0:d210:52fa:fe00:7ad7/64 scope global",
+                "0",
+            )
+        },
+        host,
+    )
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    find_IPv6_information
+    """
+    )
+    expected_stdout = "Found IPv6 ULA address"
+    assert expected_stdout in detectPlatform.stdout
+
+
+def test_IPv6_only_GUA(host):
+    """
+    confirms IPv6 blocking is enabled for GUA addresses
+    """
+    # mock ip -6 address to return GUA address
+    mock_command_2(
+        "ip",
+        {
+            "-6 address": (
+                "inet6 2003:12:1e43:301:d210:52fa:fe00:7ad7/64 scope global",
+                "0",
+            )
+        },
+        host,
+    )
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    find_IPv6_information
+    """
+    )
+    expected_stdout = "Found IPv6 GUA address"
+    assert expected_stdout in detectPlatform.stdout
+
+
+def test_IPv6_GUA_ULA_test(host):
+    """
+    confirms IPv6 blocking is enabled for GUA and ULA addresses
+    """
+    # mock ip -6 address to return GUA and ULA addresses
+    mock_command_2(
+        "ip",
+        {
+            "-6 address": (
+                "inet6 2003:12:1e43:301:d210:52fa:fe00:7ad7/64 scope global\n"
+                "inet6 fda2:2001:5555:0:d210:52fa:fe00:7ad7/64 scope global",
+                "0",
+            )
+        },
+        host,
+    )
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    find_IPv6_information
+    """
+    )
+    expected_stdout = "Found IPv6 ULA address"
+    assert expected_stdout in detectPlatform.stdout
+
+
+def test_IPv6_ULA_GUA_test(host):
+    """
+    confirms IPv6 blocking is enabled for GUA and ULA addresses
+    """
+    # mock ip -6 address to return ULA and GUA addresses
+    mock_command_2(
+        "ip",
+        {
+            "-6 address": (
+                "inet6 fda2:2001:5555:0:d210:52fa:fe00:7ad7/64 scope global\n"
+                "inet6 2003:12:1e43:301:d210:52fa:fe00:7ad7/64 scope global",
+                "0",
+            )
+        },
+        host,
+    )
+    detectPlatform = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    find_IPv6_information
+    """
+    )
+    expected_stdout = "Found IPv6 ULA address"
+    assert expected_stdout in detectPlatform.stdout
+
+
+def test_validate_ip(host):
+    """
+    Tests valid_ip for various IP addresses
+    """
+
+    def test_address(addr, success=True):
+        output = host.run(
+            """
+        source /opt/pihole/basic-install.sh
+        valid_ip "{addr}"
+        """.format(
+                addr=addr
+            )
+        )
+
+        assert output.rc == 0 if success else 1
+
+    test_address("192.168.1.1")
+    test_address("127.0.0.1")
+    test_address("255.255.255.255")
+    test_address("255.255.255.256", False)
+    test_address("255.255.256.255", False)
+    test_address("255.256.255.255", False)
+    test_address("256.255.255.255", False)
+    test_address("1092.168.1.1", False)
+    test_address("not an IP", False)
+    test_address("8.8.8.8#", False)
+    test_address("8.8.8.8#0")
+    test_address("8.8.8.8#1")
+    test_address("8.8.8.8#42")
+    test_address("8.8.8.8#888")
+    test_address("8.8.8.8#1337")
+    test_address("8.8.8.8#65535")
+    test_address("8.8.8.8#65536", False)
+    test_address("8.8.8.8#-1", False)
+    test_address("00.0.0.0", False)
+    test_address("010.0.0.0", False)
+    test_address("001.0.0.0", False)
+    test_address("0.0.0.0#00", False)
+    test_address("0.0.0.0#01", False)
+    test_address("0.0.0.0#001", False)
+    test_address("0.0.0.0#0001", False)
+    test_address("0.0.0.0#00001", False)
+
+
+def test_os_check_fails(host):
+    """Confirms install fails on unsupported OS"""
+    host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    build_dependency_package
+    install_dependent_packages
+    cat <<EOT > /etc/os-release
+ID=UnsupportedOS
+VERSION_ID="2"
+EOT
+    """
+    )
+    detectOS = host.run(
+        """t
+    source /opt/pihole/basic-install.sh
+    os_check
+    """
+    )
+    expected_stdout = "Unsupported OS detected: UnsupportedOS"
+    assert expected_stdout in detectOS.stdout
+
+
+def test_os_check_passes(host):
+    """Confirms OS meets the requirements"""
+    host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    build_dependency_package
+    install_dependent_packages
+    """
+    )
+    detectOS = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    os_check
+    """
+    )
+    expected_stdout = "Supported OS detected"
+    assert expected_stdout in detectOS.stdout
+
+
+def test_package_manager_has_pihole_deps(host):
+    """Confirms OS is able to install the required packages for Pi-hole"""
+    mock_command("dialog", {"*": ("", "0")}, host)
+    output = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    build_dependency_package
+    install_dependent_packages
+    """
+    )
+
+    assert "No package" not in output.stdout
+    assert output.rc == 0
+
+
+def test_meta_package_uninstall(host):
+    """Confirms OS is able to install and uninstall the Pi-hole meta package"""
+    mock_command("dialog", {"*": ("", "0")}, host)
+    install = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    package_manager_detect
+    build_dependency_package
+    install_dependent_packages
+    """
+    )
+    assert install.rc == 0
+
+    uninstall = host.run(
+        """
+    source /opt/pihole/uninstall.sh
+    removeMetaPackage
+    """
+    )
+    assert uninstall.rc == 0

test/test_any_utils.py

@@ -0,0 +1,59 @@
+def test_key_val_replacement_works(host):
+    """Confirms addOrEditKeyValPair either adds or replaces a key value pair in a given file"""
+    host.run(
+        """
+    source /opt/pihole/utils.sh
+    addOrEditKeyValPair "./testoutput" "KEY_ONE" "value1"
+    addOrEditKeyValPair "./testoutput" "KEY_TWO" "value2"
+    addOrEditKeyValPair "./testoutput" "KEY_ONE" "value3"
+    addOrEditKeyValPair "./testoutput" "KEY_FOUR" "value4"
+    """
+    )
+    output = host.run(
+        """
+    cat ./testoutput
+    """
+    )
+    expected_stdout = "KEY_ONE=value3\nKEY_TWO=value2\nKEY_FOUR=value4\n"
+    assert expected_stdout == output.stdout
+
+
+def test_getFTLPID_default(host):
+    """Confirms getFTLPID returns the default value if FTL is not running"""
+    output = host.run(
+        """
+    source /opt/pihole/utils.sh
+    getFTLPID
+    """
+    )
+    expected_stdout = "-1\n"
+    assert expected_stdout == output.stdout
+
+
+def test_setFTLConfigValue_getFTLConfigValue(host):
+    """
+    Confirms getFTLConfigValue works (also assumes setFTLConfigValue works)
+    Requires FTL to be installed, so we do that first
+    (taken from test_FTL_development_binary_installed_and_responsive_no_errors)
+    """
+    host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    create_pihole_user
+    funcOutput=$(get_binary_name)
+    echo "development" > /etc/pihole/ftlbranch
+    binary="pihole-FTL${funcOutput##*pihole-FTL}"
+    theRest="${funcOutput%pihole-FTL*}"
+    FTLdetect "${binary}" "${theRest}"
+    """
+    )
+
+    output = host.run(
+        """
+    source /opt/pihole/utils.sh
+    setFTLConfigValue "dns.upstreams" '["9.9.9.9"]' > /dev/null
+    getFTLConfigValue "dns.upstreams"
+    """
+    )
+
+    assert "[ 9.9.9.9 ]" in output.stdout

test/test_centos_fedora_common_support.py

@@ -0,0 +1,75 @@
+from .conftest import (
+    tick_box,
+    cross_box,
+    mock_command,
+)
+
+
+def mock_selinux_config(state, host):
+    """
+    Creates a mock SELinux config file with expected content
+    """
+    # validate state string
+    valid_states = ["enforcing", "permissive", "disabled"]
+    assert state in valid_states
+    # getenforce returns the running state of SELinux
+    mock_command("getenforce", {"*": (state.capitalize(), "0")}, host)
+    # create mock configuration with desired content
+    host.run(
+        """
+    mkdir /etc/selinux
+    echo "SELINUX={state}" > /etc/selinux/config
+    """.format(
+            state=state.lower()
+        )
+    )
+
+
+def test_selinux_enforcing_exit(host):
+    """
+    confirms installer prompts to exit when SELinux is Enforcing by default
+    """
+    mock_selinux_config("enforcing", host)
+    check_selinux = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    checkSelinux
+    """
+    )
+    expected_stdout = cross_box + " Current SELinux: enforcing"
+    assert expected_stdout in check_selinux.stdout
+    expected_stdout = "SELinux Enforcing detected, exiting installer"
+    assert expected_stdout in check_selinux.stdout
+    assert check_selinux.rc == 1
+
+
+def test_selinux_permissive(host):
+    """
+    confirms installer continues when SELinux is Permissive
+    """
+    mock_selinux_config("permissive", host)
+    check_selinux = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    checkSelinux
+    """
+    )
+    expected_stdout = tick_box + " Current SELinux: permissive"
+    assert expected_stdout in check_selinux.stdout
+    assert check_selinux.rc == 0
+
+
+def test_selinux_disabled(host):
+    """
+    confirms installer continues when SELinux is Disabled
+    """
+    mock_selinux_config("disabled", host)
+    check_selinux = host.run(
+        """
+    source /opt/pihole/basic-install.sh
+    checkSelinux
+    """
+    )
+    expected_stdout = tick_box + " Current SELinux: disabled"
+    assert expected_stdout in check_selinux.stdout
+    assert check_selinux.rc == 0

test/tox.centos_9.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv:py3]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _centos_9.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py ./test_centos_fedora_common_support.py

test/tox.debian_11.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv:py3]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _debian_11.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py

test/tox.debian_12.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv:py3]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _debian_12.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py

test/tox.fedora_40.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _fedora_40.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py ./test_centos_fedora_common_support.py

test/tox.fedora_41.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _fedora_41.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py ./test_centos_fedora_common_support.py

test/tox.ubuntu_20.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv:py3]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _ubuntu_20.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py

test/tox.ubuntu_22.ini

@@ -0,0 +1,10 @@
+[tox]
+envlist = py3
+
+[testenv:py3]
+allowlist_externals = docker
+deps = -rrequirements.txt
+setenv =
+    COLUMNS=120
+commands = docker buildx build --load --progress plain -f _ubuntu_22.Dockerfile -t pytest_pihole:test_container ../
+           pytest {posargs:-vv -n auto} ./test_any_automated_install.py ./test_any_utils.py