vps/hosts/dns.windy.lan.md

dns.windy.lan — AdGuard Home LAN DNS

Role and access

Item	Value
IPv4	192.168.66.36
SSH	ssh -4 windy@192.168.66.36
OS	Debian 12
Host	PVE VM 120 (pihole) — not a separate physical host (verified 2026-08-09)
Roles	AdGuard Home LAN DNS; Mihomo explicit-proxy service

Use windy for routine inspection. Do not store credentials, AdGuard Home user hashes, proxy subscriptions, or query-log contents in this repository.

AdGuard Home

AdGuard Home runs as the root-owned adguardhome Docker container in host network mode. The persistent deployment is /opt/adguardhome:

Item	Path / setting
Compose file	/opt/adguardhome/docker-compose.yml
Configuration	/opt/adguardhome/conf/AdGuardHome.yaml
Mutable data and query logs	/opt/adguardhome/work
DNS	TCP/UDP 53; intentionally no source ACL so both LAN55 and LAN66 work
HTTP UI	192.168.66.36:80; LAN66 only
Image policy	Pin the reviewed image digest; do not use latest for a rebuild

The EdgeRouter DHCP service advertises this host as DNS for LAN55 and LAN66. Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is explicitly migrated and disabled first.

agh-ui-access.service loads /etc/nftables-agh-ui-access.nft. It permits 192.168.66.0/24 (LAN66) and 192.168.55.0/24 (LAN55, for Home Assistant integration) to TCP/80 and drops other TCP/80 input. It deliberately does not restrict DNS, SSH, Docker, or Mihomo ports. Keep it isolated from Docker-managed nftables tables.

2026-08-12: added 192.168.55.0/24 allow so HAOS (192.168.55.11) can reach the HTTP API on :80 for the Home Assistant AdGuard Home integration; applied via sudo systemctl restart agh-ui-access.service (file edited first, then reloaded; syntax verified with nft -c). Other firewalls (EdgeRouter LAN_IN/ LAN_OUT inactive, PVE zero rules) were already open for LAN55->LAN66.

Current query-log policy is 14 days with anonymized client IPs. Check free space before increasing retention. DNSSEC is disabled because the selected upstream path did not pass the known-bad-signature validation check; do not enable it without re-testing validated upstreams.

The compatible names hass.windy.lan and legacy hass.local currently point to the same Home Assistant address. Migrate clients to hass.windy.lan; keep the legacy rewrite until its planned retirement.

Mihomo and routing boundary

Mihomo listens for explicit proxy traffic on this host. Read-only checks found no host TUN policy routing or local nftables/iptables transparent-redirection rules. A Mihomo listener alone does not mean it intercepts AdGuard Home traffic. The default gateway (gfw.windy.lan) can still affect outbound traffic, so inspect its OpenClash rules separately before changing upstream routing.

Safety

• Back up /opt/adguardhome/conf/AdGuardHome.yaml and docker-compose.yml before changing either, then run the official --check-config command.
• Recreate only the AdGuard Home container and verify DNS A/AAAA, local names, the UI from LAN66, and the UI denial from LAN55 afterwards.
• Private PTR currently has no local authoritative source: direct EdgeRouter PTR queries return NXDOMAIN. Do not point local_ptr_upstreams at the router until that source exists.

See the health runbook and the official configuration review.

Routine health through Ansible (--limit adguardhome), with a daily timer + email alerting like the other active hosts:

cd ansible
ansible-playbook playbooks/health-report.yml --limit adguardhome