Pi-Hole/docs
1
0
Fork 0
mirror of https://github.com/pi-hole/docs.git synced 2026-08-22 22:28:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1374 from pi-hole/update-pihole-toml-docs

Browse Source 
Update pihole.toml documentation
This commit is contained in:
Adam Warner
2026-04-25 00:18:27 +01:00
committed by GitHub
parent 891b08476e be939c1f3c
commit 47e192ae84
1 changed files with 15 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ftldns/configfile.md
+15 -34
View File
@@ -95,18 +95,23 @@ true or false
### `blockESNI`
Should `_esni.` subdomains be blocked by default? Encrypted Server Name Indication
(ESNI) is certainly a good step into the right direction to enhance privacy on the
web. It prevents on-path observers, including ISPs, coffee shop owners and
firewalls, from intercepting the TLS Server Name Indication (SNI) extension by
encrypting it. This prevents the SNI from being used to determine which websites
users are visiting.
Should `_esni.` subdomains of blocked domains also be blocked by default? Encrypted
Server Name Indication (ESNI) is certainly a good step into the right direction to
enhance privacy on the web. It prevents on-path observers, including ISPs, coffee
shop owners and firewalls, from intercepting the TLS Server Name Indication (SNI)
extension by encrypting it. This prevents the SNI from being used to determine which
websites users are visiting.
ESNI will obviously cause issues for pixelserv-tls which will be unable to generate
matching certificates on-the-fly when it cannot read the SNI. Cloudflare and Firefox
are already enabling ESNI. According to the IETF draft (link above), we can easily
restore pixelserv-tls's operation by replying NXDOMAIN to `_esni.` subdomains of
blocked domains as this mimics a `"not configured for this domain"` behavior.
matching certificates on-the-fly when it cannot read the SNI. According to the IETF
draft (link above), we can easily restore pixelserv-tls's operation by replying
NXDOMAIN to `_esni.` subdomains of blocked domains as this mimics a `"not configured
for this domain"` behavior.
ESNI is mostly obsolete. It was previously rolled out by Cloudflare and Firefox, but
they, as well as almost every client and server, are now using Encrypted Client
Hello (ECH) instead of ESNI. ECH is served via the HTTPS record on the same RRname,
so it will automatically be blocked.
**Allowed values are:**
true or false
@@ -3423,30 +3428,6 @@ Kelvin
## `[files]`
### `pid`
The file which contains the PID of FTL's main process.
**Allowed values are:**
Any writable file
**Default value:** `"/run/pihole-FTL.pid"`
=== "TOML"
```toml
[files]
pid = "/run/pihole-FTL.pid"
```
=== "CLI"
```shell
sudo pihole-FTL --config files.pid "/run/pihole-FTL.pid"
```
=== "Environment (Docker Compose)"
```yaml
environment:
FTLCONF_files_pid: '/run/pihole-FTL.pid'
```
### `database`
The location of FTL's long-term database