windyboyandCursor
343c5db415
Keep sanitized Compose sources in-repo with a confirmation-gated Ansible playbook, add repo-wide validation, tighten runbook ownership/STOP/review metadata, and archive stale research docs. Co-authored-by: Cursor <cursoragent@cursor.com>
82 lines
2.6 KiB
Markdown
82 lines
2.6 KiB
Markdown
# AdGuard Home health — dns.windy.lan
|
|
|
|
## Purpose
|
|
|
|
Read-only health check of the AdGuard Home LAN DNS service.
|
|
|
|
## Scope
|
|
|
|
- Applicable: [dns.windy.lan](../hosts/dns.windy.lan.md) (`192.168.66.36`).
|
|
- Read-only: does not expose query-log contents or secrets; does not change configuration.
|
|
|
|
## Ownership
|
|
|
|
- Owner: personal ops (Windy)
|
|
- Last reviewed: 2026-08-17
|
|
- Related systems: dns.windy.lan (`/opt/adguardhome`)
|
|
|
|
This runbook is read-only. It does not expose query-log contents or secrets.
|
|
|
|
Routine checks run through Ansible on demand:
|
|
|
|
```bash
|
|
cd ansible
|
|
ansible-playbook playbooks/health-report.yml --limit adguardhome
|
|
```
|
|
|
|
The same sanitized profile is installed as a daily server-local timer
|
|
(`vps-healthcheck.timer`, output at `/var/lib/vps-health/latest.json`) via
|
|
`playbooks/healthchecks.yml`; the manual checks below are for focused diagnosis.
|
|
|
|
## Verify service and configuration
|
|
|
|
```bash
|
|
ssh -4 -o BatchMode=yes windy@192.168.66.36
|
|
sudo docker ps --filter name=^/adguardhome$
|
|
sudo docker exec adguardhome /opt/adguardhome/AdGuardHome --check-config \
|
|
-c /opt/adguardhome/conf/AdGuardHome.yaml
|
|
sudo ss -lntup | grep -E '(:53|:80)'
|
|
```
|
|
|
|
Expected: DNS listens on TCP/UDP 53, and the HTTP UI listens only on
|
|
`192.168.66.36:80`.
|
|
|
|
## Verify DNS and storage
|
|
|
|
```bash
|
|
dig +time=5 +tries=1 @192.168.66.36 example.com A +noall +comments +answer
|
|
dig +time=5 +tries=1 @192.168.66.36 example.com AAAA +noall +comments +answer
|
|
dig +time=5 +tries=1 @192.168.66.36 hass.windy.lan A +noall +comments +answer
|
|
sudo docker logs --since 30m adguardhome 2>&1 | grep -Ei '\[(error|warn|fatal)\]|level=(error|warn|fatal)' || true
|
|
df -h /opt/adguardhome/work
|
|
```
|
|
|
|
The host intentionally accepts DNS from LAN55 and LAN66. Do not infer a
|
|
broken DNS policy merely because `allowed_clients` is empty.
|
|
|
|
## Verify management UI boundary
|
|
|
|
From LAN66, the UI should return a login redirect:
|
|
|
|
```bash
|
|
curl -sS -o /dev/null -w '%{http_code}\n' http://192.168.66.36/
|
|
```
|
|
|
|
From a LAN55 source, TCP/80 should time out or be refused by the dedicated
|
|
`agh-ui-access.service` nftables rule. Do not alter this rule to restrict
|
|
port 53 without an explicit network-access review.
|
|
|
|
## DNSSEC and PTR caveats
|
|
|
|
DNSSEC is currently disabled. Before enabling it, select upstreams that pass
|
|
a known-bad-signature test; an enabled DO bit alone is not validation.
|
|
|
|
Private PTR forwarding is intentionally absent because the EdgeRouter does
|
|
not currently answer private PTR requests.
|
|
|
|
## Safety
|
|
|
|
- Read-only: never change the DNS policy or the `agh-ui-access.service` nftables rule during this check.
|
|
- Do not infer a broken DNS policy from an empty `allowed_clients`.
|
|
- If live state conflicts with an expected value, `STOP` and report.
|