windyboy
b03d7019c4
- Add dns.windy.lan to Ansible inventory (adguardhome group/profile) with a read-only healthcheck template, systemd timer, and on-demand report parity with the other active hosts; verified green on the host. - Add synapse.chans.xyz to the AGENTS.md active-host quick map. - Remove plans/; migrate decisions/verification to a Linear vps project doc and file the remaining gaps as W1N-46..49 with blocking edges. - Retire scripts/check-mx2.sh; point mailcow health/update runbooks and the mx2 host file at the Ansible health report. - Trim us2 stub software to verified running services; note dormant dirs. - Normalize repo docs to English; drop the non-existent CONTEXT.md/ADR claim and remove docs/agents/domain.md.
3.1 KiB
dns.windy.lan — AdGuard Home LAN DNS
Role and access
| Item | Value |
|---|---|
| IPv4 | 192.168.66.36 |
| SSH | ssh -4 windy@192.168.66.36 |
| OS | Debian 12 |
| Roles | AdGuard Home LAN DNS; Mihomo explicit-proxy service |
Use windy for routine inspection. Do not store credentials, AdGuard Home
user hashes, proxy subscriptions, or query-log contents in this repository.
AdGuard Home
AdGuard Home runs as the root-owned adguardhome Docker container in host
network mode. The persistent deployment is /opt/adguardhome:
| Item | Path / setting |
|---|---|
| Compose file | /opt/adguardhome/docker-compose.yml |
| Configuration | /opt/adguardhome/conf/AdGuardHome.yaml |
| Mutable data and query logs | /opt/adguardhome/work |
| DNS | TCP/UDP 53; intentionally no source ACL so both LAN55 and LAN66 work |
| HTTP UI | 192.168.66.36:80; LAN66 only |
| Image policy | Pin the reviewed image digest; do not use latest for a rebuild |
The EdgeRouter DHCP service advertises this host as DNS for LAN55 and LAN66. Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is explicitly migrated and disabled first.
agh-ui-access.service loads /etc/nftables-agh-ui-access.nft. It permits
only 192.168.66.0/24 to TCP/80 and drops other TCP/80 input. It deliberately
does not restrict DNS, SSH, Docker, or Mihomo ports. Keep it isolated from
Docker-managed nftables tables.
Current query-log policy is 14 days with anonymized client IPs. Check free space before increasing retention. DNSSEC is disabled because the selected upstream path did not pass the known-bad-signature validation check; do not enable it without re-testing validated upstreams.
The compatible names hass.windy.lan and legacy hass.local currently point
to the same Home Assistant address. Migrate clients to hass.windy.lan; keep
the legacy rewrite until its planned retirement.
Mihomo and routing boundary
Mihomo listens for explicit proxy traffic on this host. Read-only checks found
no host TUN policy routing or local nftables/iptables transparent-redirection
rules. A Mihomo listener alone does not mean it intercepts AdGuard Home
traffic. The default gateway (gfw.windy.lan) can still affect outbound
traffic, so inspect its OpenClash rules separately before changing upstream
routing.
Safety
- Back up
/opt/adguardhome/conf/AdGuardHome.yamlanddocker-compose.ymlbefore changing either, then run the official--check-configcommand. - Recreate only the AdGuard Home container and verify DNS A/AAAA, local names, the UI from LAN66, and the UI denial from LAN55 afterwards.
- Private PTR currently has no local authoritative source: direct EdgeRouter
PTR queries return NXDOMAIN. Do not point
local_ptr_upstreamsat the router until that source exists.
See the health runbook and the official configuration review.
Routine health through Ansible (--limit adguardhome), with a daily timer +
email alerting like the other active hosts:
cd ansible
ansible-playbook playbooks/health-report.yml --limit adguardhome