# dns.windy.lan — AdGuard Home LAN DNS

## Role and access

| Item | Value |
|---|---|
| IPv4 | `192.168.66.36` |
| SSH | `ssh -4 windy@192.168.66.36` |
| OS | Debian 12 |
| **Host** | **PVE VM 120 (`pihole`)** — not a separate physical host (verified 2026-08-09) |
| Roles | AdGuard Home LAN DNS; Mihomo explicit-proxy service |

Use `windy` for routine inspection.  Do not store credentials, AdGuard Home
user hashes, proxy subscriptions, or query-log contents in this repository.

## AdGuard Home

AdGuard Home runs as the root-owned `adguardhome` Docker container in host
network mode.  The persistent deployment is `/opt/adguardhome`:

| Item | Path / setting |
|---|---|
| Compose file | `/opt/adguardhome/docker-compose.yml` |
| Configuration | `/opt/adguardhome/conf/AdGuardHome.yaml` |
| Mutable data and query logs | `/opt/adguardhome/work` |
| DNS | TCP/UDP `53`; intentionally no source ACL so both LAN55 and LAN66 work |
| HTTP UI | `192.168.66.36:80`; LAN66 only |
| Image policy | Pin the reviewed image digest; do not use `latest` for a rebuild |

The EdgeRouter DHCP service advertises this host as DNS for LAN55 and LAN66.
Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is
explicitly migrated and disabled first.

`agh-ui-access.service` loads `/etc/nftables-agh-ui-access.nft`.  It permits
`192.168.66.0/24` (LAN66) and `192.168.55.0/24` (LAN55, for Home Assistant
integration) to TCP/80 and drops other TCP/80 input.  It deliberately
does **not** restrict DNS, SSH, Docker, or Mihomo ports.  Keep it isolated from
Docker-managed nftables tables.

> 2026-08-12: added `192.168.55.0/24` allow so HAOS (`192.168.55.11`) can reach
the HTTP API on `:80` for the Home Assistant AdGuard Home integration; applied
via `sudo systemctl restart agh-ui-access.service` (file edited first, then
reloaded; syntax verified with `nft -c`). Other firewalls (EdgeRouter LAN_IN/
LAN_OUT inactive, PVE zero rules) were already open for LAN55->LAN66.

Current query-log policy is 14 days with anonymized client IPs.  Check free
space before increasing retention.  DNSSEC is disabled because the selected
upstream path did not pass the known-bad-signature validation check; do not
enable it without re-testing validated upstreams.

The compatible names `hass.windy.lan` and legacy `hass.local` currently point
to the same Home Assistant address.  Migrate clients to `hass.windy.lan`; keep
the legacy rewrite until its planned retirement.

## Mihomo and routing boundary

Mihomo listens for explicit proxy traffic on this host.  Read-only checks found
no host TUN policy routing or local nftables/iptables transparent-redirection
rules.  A Mihomo listener alone does not mean it intercepts AdGuard Home
traffic.  The default gateway (`gfw.windy.lan`) can still affect outbound
traffic, so inspect its OpenClash rules separately before changing upstream
routing.

## Safety

- Back up `/opt/adguardhome/conf/AdGuardHome.yaml` and `docker-compose.yml`
  before changing either, then run the official `--check-config` command.
- Recreate only the AdGuard Home container and verify DNS A/AAAA, local names,
  the UI from LAN66, and the UI denial from LAN55 afterwards.
- Private PTR currently has no local authoritative source: direct EdgeRouter
  PTR queries return NXDOMAIN.  Do not point `local_ptr_upstreams` at the
  router until that source exists.

See [the health runbook](../runbooks/adguard-home-health.md) and
[the official configuration review](../docs/adguard-home-official-review-2026-08.md).

Routine health through Ansible (`--limit adguardhome`), with a daily timer +
email alerting like the other active hosts:

```bash
cd ansible
ansible-playbook playbooks/health-report.yml --limit adguardhome
```