2026-08-06 15:48:48 +08:00
|
|
|
# dns.windy.lan — AdGuard Home LAN DNS
|
|
|
|
|
|
|
|
|
|
## Role and access
|
|
|
|
|
|
|
|
|
|
| Item | Value |
|
|
|
|
|
|---|---|
|
|
|
|
|
| IPv4 | `192.168.66.36` |
|
|
|
|
|
| SSH | `ssh -4 windy@192.168.66.36` |
|
|
|
|
|
| OS | Debian 12 |
|
2026-08-09 21:22:02 +08:00
|
|
|
| **Host** | **PVE VM 120 (`pihole`)** — not a separate physical host (verified 2026-08-09) |
|
2026-08-06 15:48:48 +08:00
|
|
|
| Roles | AdGuard Home LAN DNS; Mihomo explicit-proxy service |
|
|
|
|
|
|
|
|
|
|
Use `windy` for routine inspection. Do not store credentials, AdGuard Home
|
|
|
|
|
user hashes, proxy subscriptions, or query-log contents in this repository.
|
|
|
|
|
|
|
|
|
|
## AdGuard Home
|
|
|
|
|
|
|
|
|
|
AdGuard Home runs as the root-owned `adguardhome` Docker container in host
|
|
|
|
|
network mode. The persistent deployment is `/opt/adguardhome`:
|
|
|
|
|
|
|
|
|
|
| Item | Path / setting |
|
|
|
|
|
|---|---|
|
|
|
|
|
| Compose file | `/opt/adguardhome/docker-compose.yml` |
|
|
|
|
|
| Configuration | `/opt/adguardhome/conf/AdGuardHome.yaml` |
|
|
|
|
|
| Mutable data and query logs | `/opt/adguardhome/work` |
|
|
|
|
|
| DNS | TCP/UDP `53`; intentionally no source ACL so both LAN55 and LAN66 work |
|
|
|
|
|
| HTTP UI | `192.168.66.36:80`; LAN66 only |
|
|
|
|
|
| Image policy | Pin the reviewed image digest; do not use `latest` for a rebuild |
|
|
|
|
|
|
|
|
|
|
The EdgeRouter DHCP service advertises this host as DNS for LAN55 and LAN66.
|
|
|
|
|
Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is
|
|
|
|
|
explicitly migrated and disabled first.
|
|
|
|
|
|
|
|
|
|
`agh-ui-access.service` loads `/etc/nftables-agh-ui-access.nft`. It permits
|
2026-08-12 08:36:51 +08:00
|
|
|
`192.168.66.0/24` (LAN66) and `192.168.55.0/24` (LAN55, for Home Assistant
|
|
|
|
|
integration) to TCP/80 and drops other TCP/80 input. It deliberately
|
2026-08-06 15:48:48 +08:00
|
|
|
does **not** restrict DNS, SSH, Docker, or Mihomo ports. Keep it isolated from
|
|
|
|
|
Docker-managed nftables tables.
|
|
|
|
|
|
2026-08-12 08:36:51 +08:00
|
|
|
> 2026-08-12: added `192.168.55.0/24` allow so HAOS (`192.168.55.11`) can reach
|
|
|
|
|
the HTTP API on `:80` for the Home Assistant AdGuard Home integration; applied
|
|
|
|
|
via `sudo systemctl restart agh-ui-access.service` (file edited first, then
|
|
|
|
|
reloaded; syntax verified with `nft -c`). Other firewalls (EdgeRouter LAN_IN/
|
|
|
|
|
LAN_OUT inactive, PVE zero rules) were already open for LAN55->LAN66.
|
|
|
|
|
|
2026-08-06 15:48:48 +08:00
|
|
|
Current query-log policy is 14 days with anonymized client IPs. Check free
|
|
|
|
|
space before increasing retention. DNSSEC is disabled because the selected
|
|
|
|
|
upstream path did not pass the known-bad-signature validation check; do not
|
|
|
|
|
enable it without re-testing validated upstreams.
|
|
|
|
|
|
|
|
|
|
The compatible names `hass.windy.lan` and legacy `hass.local` currently point
|
|
|
|
|
to the same Home Assistant address. Migrate clients to `hass.windy.lan`; keep
|
|
|
|
|
the legacy rewrite until its planned retirement.
|
|
|
|
|
|
|
|
|
|
## Mihomo and routing boundary
|
|
|
|
|
|
|
|
|
|
Mihomo listens for explicit proxy traffic on this host. Read-only checks found
|
|
|
|
|
no host TUN policy routing or local nftables/iptables transparent-redirection
|
|
|
|
|
rules. A Mihomo listener alone does not mean it intercepts AdGuard Home
|
|
|
|
|
traffic. The default gateway (`gfw.windy.lan`) can still affect outbound
|
|
|
|
|
traffic, so inspect its OpenClash rules separately before changing upstream
|
|
|
|
|
routing.
|
|
|
|
|
|
|
|
|
|
## Safety
|
|
|
|
|
|
|
|
|
|
- Back up `/opt/adguardhome/conf/AdGuardHome.yaml` and `docker-compose.yml`
|
|
|
|
|
before changing either, then run the official `--check-config` command.
|
|
|
|
|
- Recreate only the AdGuard Home container and verify DNS A/AAAA, local names,
|
|
|
|
|
the UI from LAN66, and the UI denial from LAN55 afterwards.
|
|
|
|
|
- Private PTR currently has no local authoritative source: direct EdgeRouter
|
|
|
|
|
PTR queries return NXDOMAIN. Do not point `local_ptr_upstreams` at the
|
|
|
|
|
router until that source exists.
|
|
|
|
|
|
|
|
|
|
See [the health runbook](../runbooks/adguard-home-health.md) and
|
|
|
|
|
[the official configuration review](../docs/adguard-home-official-review-2026-08.md).
|
|
|
|
|
|
|
|
|
|
Routine health through Ansible (`--limit adguardhome`), with a daily timer +
|
|
|
|
|
email alerting like the other active hosts:
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
cd ansible
|
|
|
|
|
ansible-playbook playbooks/health-report.yml --limit adguardhome
|
|
|
|
|
```
|
