diff --git a/apply.sh b/apply.sh
index 337c331..dd6f976 100755
--- a/apply.sh
+++ b/apply.sh
@@ -49,3 +49,7 @@ helm upgrade --install influxdb bitnami/influxdb --namespace db \
 
 # create secret
 kubectl -n apps create secret generic database-credentials --from-literal=password=wGWHn9bhjJbM27V
+
+k apply -f pihole-pv.yaml -n home-apps
+
+kubectl -n home-apps create secret generic pihole-admin-password --from-literal=webpassword=Uj2s3iUkRubkJs4
diff --git a/pihole-pv.yaml b/pihole-pv.yaml
new file mode 100644
index 0000000..2ca26d4
--- /dev/null
+++ b/pihole-pv.yaml
@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: "pihole"
+  labels:
+    type: "local"
+spec:
+  storageClassName: "manual"
+  capacity:
+    storage: "500Mi"
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/mnt/pihole"
+---
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: "home-apps"
+  name: "pihole"
+spec:
+  storageClassName: "manual"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "500Mi"
+
+---
+
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: "dnsmasq"
+  labels:
+    type: "local"
+spec:
+  storageClassName: "manual"
+  capacity:
+    storage: "1Gi"
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/mnt/dnsmasq"
+---
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: "home-apps"
+  name: "dnsmasq"
+spec:
+  storageClassName: "manual"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+
+---
diff --git a/pihole.yaml b/pihole.yaml
new file mode 100644
index 0000000..1b2fe17
--- /dev/null
+++ b/pihole.yaml
@@ -0,0 +1,136 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  labels:
+    app: pihole
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+        name: pihole
+    spec:
+      containers:
+        - name: pihole
+          image: pihole/pihole:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+              name: pihole-http
+              protocol: TCP
+            - containerPort: 53
+              name: dns
+              protocol: TCP
+            - containerPort: 53
+              name: dns-udp
+              protocol: UDP
+            - containerPort: 443
+              name: pihole-ssl
+              protocol: TCP
+            - containerPort: 67
+              name: client-udp
+              protocol: UDP
+          env:
+            - name: TZ
+              value: "Australia/Melbourne"
+            - name: WEBPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: pihole-admin-password
+                  key: webpassword
+            - name: DNS1
+              value: '1.1.1.1'
+            - name: DNS2
+              value: '8.8.8.8'
+            - name: VIRTUAL_HOST
+              value: 'pihole.home.toozhao.com'
+          volumeMounts:
+            - name: pihole-local-etc-volume
+              mountPath: "/etc/pihole"
+            - name: pihole-local-dnsmasq-volume
+              mountPath: "/etc/dnsmasq.d"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 200Mi
+            limits:
+              cpu: 200m
+              memory: 400Mi
+      volumes:
+      - name: pihole-local-etc-volume
+        persistentVolumeClaim:
+          claimName: pihole
+      - name: pihole-local-dnsmasq-volume
+        persistentVolumeClaim:
+          claimName: dnsmasq
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-dns
+  labels:
+    name: pihole-dns
+spec:
+  type: NodePort
+  externalIPs:
+    - 192.168.1.2
+  selector:
+    app: pihole
+  externalTrafficPolicy: Local
+  ports:
+  - name: dns
+    port: 53
+    protocol: UDP
+  - name: dnstcp
+    port: 53
+    protocol: TCP
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-web
+  labels:
+    name: pihole-web
+spec:
+  type: ClusterIP
+  selector:
+    app: pihole
+  ports:
+    - name: pihole
+      targetPort: pihole-http
+      port: 80
+      protocol: TCP
+
+---
+
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: pihole-ingress
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/auth-url: "https://id.home.toozhao.com/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://id.home.toozhao.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
+spec:
+  tls:
+  - hosts:
+    - pihole.home.toozhao.com
+    secretName: pihole-tls
+  rules:
+  - host: pihole.home.toozhao.com
+    http:
+      paths:
+      - backend:
+          serviceName: pihole-web
+          servicePort: 80