docs: onboard AdGuard Home to Ansible; retire check-mx2; migrate plan to Linear
- Add dns.windy.lan to Ansible inventory (adguardhome group/profile) with a read-only healthcheck template, systemd timer, and on-demand report parity with the other active hosts; verified green on the host. - Add synapse.chans.xyz to the AGENTS.md active-host quick map. - Remove plans/; migrate decisions/verification to a Linear vps project doc and file the remaining gaps as W1N-46..49 with blocking edges. - Retire scripts/check-mx2.sh; point mailcow health/update runbooks and the mx2 host file at the Ansible health report. - Trim us2 stub software to verified running services; note dormant dirs. - Normalize repo docs to English; drop the non-existent CONTEXT.md/ADR claim and remove docs/agents/domain.md.
This commit is contained in:
windyboy
@@ -0,0 +1,75 @@
|
||||
# dns.windy.lan — AdGuard Home LAN DNS
|
||||
|
||||
## Role and access
|
||||
|
||||
| Item | Value |
|
||||
|---|---|
|
||||
| IPv4 | `192.168.66.36` |
|
||||
| SSH | `ssh -4 windy@192.168.66.36` |
|
||||
| OS | Debian 12 |
|
||||
| Roles | AdGuard Home LAN DNS; Mihomo explicit-proxy service |
|
||||
|
||||
Use `windy` for routine inspection. Do not store credentials, AdGuard Home
|
||||
user hashes, proxy subscriptions, or query-log contents in this repository.
|
||||
|
||||
## AdGuard Home
|
||||
|
||||
AdGuard Home runs as the root-owned `adguardhome` Docker container in host
|
||||
network mode. The persistent deployment is `/opt/adguardhome`:
|
||||
|
||||
| Item | Path / setting |
|
||||
|---|---|
|
||||
| Compose file | `/opt/adguardhome/docker-compose.yml` |
|
||||
| Configuration | `/opt/adguardhome/conf/AdGuardHome.yaml` |
|
||||
| Mutable data and query logs | `/opt/adguardhome/work` |
|
||||
| DNS | TCP/UDP `53`; intentionally no source ACL so both LAN55 and LAN66 work |
|
||||
| HTTP UI | `192.168.66.36:80`; LAN66 only |
|
||||
| Image policy | Pin the reviewed image digest; do not use `latest` for a rebuild |
|
||||
|
||||
The EdgeRouter DHCP service advertises this host as DNS for LAN55 and LAN66.
|
||||
Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is
|
||||
explicitly migrated and disabled first.
|
||||
|
||||
`agh-ui-access.service` loads `/etc/nftables-agh-ui-access.nft`. It permits
|
||||
only `192.168.66.0/24` to TCP/80 and drops other TCP/80 input. It deliberately
|
||||
does **not** restrict DNS, SSH, Docker, or Mihomo ports. Keep it isolated from
|
||||
Docker-managed nftables tables.
|
||||
|
||||
Current query-log policy is 14 days with anonymized client IPs. Check free
|
||||
space before increasing retention. DNSSEC is disabled because the selected
|
||||
upstream path did not pass the known-bad-signature validation check; do not
|
||||
enable it without re-testing validated upstreams.
|
||||
|
||||
The compatible names `hass.windy.lan` and legacy `hass.local` currently point
|
||||
to the same Home Assistant address. Migrate clients to `hass.windy.lan`; keep
|
||||
the legacy rewrite until its planned retirement.
|
||||
|
||||
## Mihomo and routing boundary
|
||||
|
||||
Mihomo listens for explicit proxy traffic on this host. Read-only checks found
|
||||
no host TUN policy routing or local nftables/iptables transparent-redirection
|
||||
rules. A Mihomo listener alone does not mean it intercepts AdGuard Home
|
||||
traffic. The default gateway (`gfw.windy.lan`) can still affect outbound
|
||||
traffic, so inspect its OpenClash rules separately before changing upstream
|
||||
routing.
|
||||
|
||||
## Safety
|
||||
|
||||
- Back up `/opt/adguardhome/conf/AdGuardHome.yaml` and `docker-compose.yml`
|
||||
before changing either, then run the official `--check-config` command.
|
||||
- Recreate only the AdGuard Home container and verify DNS A/AAAA, local names,
|
||||
the UI from LAN66, and the UI denial from LAN55 afterwards.
|
||||
- Private PTR currently has no local authoritative source: direct EdgeRouter
|
||||
PTR queries return NXDOMAIN. Do not point `local_ptr_upstreams` at the
|
||||
router until that source exists.
|
||||
|
||||
See [the health runbook](../runbooks/adguard-home-health.md) and
|
||||
[the official configuration review](../docs/adguard-home-official-review-2026-08.md).
|
||||
|
||||
Routine health through Ansible (`--limit adguardhome`), with a daily timer +
|
||||
email alerting like the other active hosts:
|
||||
|
||||
```bash
|
||||
cd ansible
|
||||
ansible-playbook playbooks/health-report.yml --limit adguardhome
|
||||
```
|
||||
Reference in New Issue
Block a user