Start a container, and its name just works.

traefik-pihole-sync keeps the local DNS records of Pi-hole in sync with your Traefik routers. Start a container with a Host() rule and its name resolves on your network a minute later; remove it and the record goes away again.

Get it on GitHub Install

Free under MIT · Small non-root container · amd64 and arm64

Traefik routerPi-hole record

Host(`grafana.lan`)A grafana.lan 192.168.1.10

Host(`wiki.lan`)A wiki.lan 192.168.1.10

Host(`photos.lan`)CNAME photos.lan nas.lan

Host(`test.lan`)container gone → record removed

No more DNS records by hand.

Every minute it reads the routers from the Traefik API, keeps the hostnames inside your domains and adds what is missing in Pi-hole.

Reads Traefik routers

Host() rules of HTTP routers and optionally HostSNI() rules of TCP routers, across every page of the Traefik API.

A, AAAA or CNAME

Point hostnames at an IPv4 and/or IPv6 address, or make them CNAMEs of your proxy host.

Several Pi-holes

Keep more than one Pi-hole in sync at once, each with its own password and state.

Domain filter

Only names inside the domains you list, so a typo can never hijack someone else's domain on your network.

Quiet logs

Changes and problems at INFO, a status line per hour, repeated errors only once.

Small container

Runs without root, built-in health check, logs out of Pi-hole on shutdown.

Safe by design

Only its own recordsRecords it did not create are never deleted, and names you manage by hand are left alone.
Delayed deletionA record goes only after its host was missing for several cycles in a row, so a restarting container causes no DNS flapping.
Dry runDRY_RUN=true logs what would change without writing anything – try it before you let it write.

One container next to Traefik.

Set the Traefik API, your Pi-hole, the target IP and your domains in the compose file, put the Pi-hole password in a secret, then start it.

Installation guide Documentation Changelog

# compose.yaml (shortened) – see the README for the secret and network
services:
  traefik-pihole-sync:
    image: ghcr.io/schnuecks/traefik-pihole-sync:latest
    restart: unless-stopped
    environment:
      TRAEFIK_API_URL: http://traefik:8080
      PIHOLE_URL: https://pihole.example.com
      PIHOLE_PASSWORD_FILE: /run/secrets/pihole_password
      TARGET_IP: 192.0.2.10
      DOMAINS: example.com
      DRY_RUN: "true"
    secrets: [pihole_password]
    volumes: [./data:/data]

Like what I build?

If one of my projects saves you time, you can buy me a coffee on Ko-fi. It keeps the printers running and the next idea coming.

Buy me a coffee on Ko-fi