eko/pihole-exporter v1.3.0

on GitHub

This release fixes the /metrics endpoint getting slower until it stalls, which forced restarts (#318, #327, #289, #332). There were two independent causes, and both are fixed.

Bug fixes

• Stalled scrapes after a timeout or a client disconnect. A scrape that timed out, or whose client gave up, left a goroutine behind that consumed the result of the next scrape, so every scrape after it hung. Each request now collects into its own channel. (#330, thanks @iSkrumpie and @nicjansma, regression test by @wfoschiera)
• Re-authentication on every API call. When Pi-hole returned a zero validity, or when no password is set, the exporter authenticated before each API call, 7 times per scrape, and each authentication costs Pi-hole seconds of CPU. The session is now reused until Pi-hole rejects it. A rejected session (Pi-hole restart, eviction) is renewed once and the call retried, instead of failing with 401 until a restart. The session is also closed on shutdown so it no longer holds an API seat. (#335, analysis by @tomoconnor in #332)
• pihole_status stuck while blocking is disabled with a timer. The timer is a float and failed to parse, which made the whole collection fail. (#336, #167)
• Stale top entries. Domains, clients and upstreams that dropped out of the top lists were exported forever with their last value, and the number of series kept growing. (#336)
• HTTPS Pi-hole with a valid certificate. The Docker image now ships CA certificates, so TLS verification works without SKIP_TLS_VERIFICATION. (#299, thanks @mnlhfr)

Features

• PIHOLE_PASSWORD_FILE. The password or API token can be read from a file, such as a Docker or Kubernetes secret. (#331, thanks @gramtech)
• pihole_top_sources_blocked metric. Blocked query count of the top blocked clients. (#336, #322)
• -healthcheck. Container health check that needs no shell nor wget. The docker-compose.yml health check, which never worked, now uses it. (#338, #46, #268)
• LOG_LEVEL / -log_level. Info and debug logs now go to stdout, warnings and errors to stderr. (#338, #118, #232)
• -version. The version is also logged at startup, along with the listening address. (#338, #156)
• Grafana dashboard data source selector. (#339, #273)

Changes

• The Docker image now runs as a non-root user (UID/GID 65532) from /app/. If you mount files into the container, such as a PIHOLE_PASSWORD_FILE, make sure that user can read them. (#324, thanks @IvanoffM)
• Docker tags: latest now points to the latest release. The development version is published as master. (#337, #292)
• New release binaries: linux-arm64, linux-armv7 and linux-armv6 (Raspberry Pi 1 and Zero). linux-arm is still published and remains an ARMv7 build. (#337, #193, #302, #321)

Documentation

• README refreshed for Pi-hole v6: application passwords, HTTPS, Docker networking, Kubernetes, health check, logging, CLI options and the metrics list. (#339, #202, #314)
• Grafana Alloy scrape example. (#296, thanks @rsatrio)
• SKIP_TLS_VERIFICATION usage. (#323, thanks @x-stp)
• Grafana dashboard: forward destinations and DNS query types panels now use short units instead of percent. (#325, #326, thanks @steventblack)

Maintenance

• Images are cross-compiled instead of built under QEMU emulation, and the archived GitHub Actions are replaced. (#337)
• Go 1.27.3 for images and binaries, prometheus/client_golang 1.23.2, confita 0.11.0, logrus 1.9.4, testify 1.11.1. (#304, #333)
• Dropped golang.org/x/net in favour of the standard library context.