windy/vps

Files

T

windyboy b0c01b2551 docs(runbooks): add runbook spec, template, index and 6 first-batch runbooks; light-enhance existing 10

- RUNBOOKS.md: repo-level spec (six-field model, naming, safety, maturity path)
- runbooks/_template.md + README.md: standard template and 16-entry routing index
- new: issue-to-merge, fix-ci, release, rollback, network-change, network-recovery
- light-enhance 10 existing runbooks with Purpose/Scope/Safety headers
- AGENTS.md: point step 3 at index/spec, add runbook execution rules
- docs/agent-runbook-guide.md: archive of Manus AI guide

2026-08-17 15:59:46 +08:00

2.5 KiB

Raw Blame History

AdGuard Home health — dns.windy.lan

Purpose

Read-only health check of the AdGuard Home LAN DNS service.

Scope

Applicable: dns.windy.lan (192.168.66.36).
Read-only: does not expose query-log contents or secrets; does not change configuration.

This runbook is read-only. It does not expose query-log contents or secrets.

Routine checks run through Ansible on demand:

cd ansible
ansible-playbook playbooks/health-report.yml --limit adguardhome

The same sanitized profile is installed as a daily server-local timer (vps-healthcheck.timer, output at /var/lib/vps-health/latest.json) via playbooks/healthchecks.yml; the manual checks below are for focused diagnosis.

Verify service and configuration

ssh -4 -o BatchMode=yes windy@192.168.66.36
sudo docker ps --filter name=^/adguardhome$
sudo docker exec adguardhome /opt/adguardhome/AdGuardHome --check-config \
  -c /opt/adguardhome/conf/AdGuardHome.yaml
sudo ss -lntup | grep -E '(:53|:80)'

Expected: DNS listens on TCP/UDP 53, and the HTTP UI listens only on 192.168.66.36:80.

Verify DNS and storage

dig +time=5 +tries=1 @192.168.66.36 example.com A +noall +comments +answer
dig +time=5 +tries=1 @192.168.66.36 example.com AAAA +noall +comments +answer
dig +time=5 +tries=1 @192.168.66.36 hass.windy.lan A +noall +comments +answer
sudo docker logs --since 30m adguardhome 2>&1 | grep -Ei '\[(error|warn|fatal)\]|level=(error|warn|fatal)' || true
df -h /opt/adguardhome/work

The host intentionally accepts DNS from LAN55 and LAN66. Do not infer a broken DNS policy merely because allowed_clients is empty.

Verify management UI boundary

From LAN66, the UI should return a login redirect:

curl -sS -o /dev/null -w '%{http_code}\n' http://192.168.66.36/

From a LAN55 source, TCP/80 should time out or be refused by the dedicated agh-ui-access.service nftables rule. Do not alter this rule to restrict port 53 without an explicit network-access review.

DNSSEC and PTR caveats

DNSSEC is currently disabled. Before enabling it, select upstreams that pass a known-bad-signature test; an enabled DO bit alone is not validation.

Private PTR forwarding is intentionally absent because the EdgeRouter does not currently answer private PTR requests.

Safety

Read-only: never change the DNS policy or the agh-ui-access.service nftables rule during this check.
Do not infer a broken DNS policy from an empty allowed_clients.
If live state conflicts with an expected value, STOP and report.

2.5 KiB Raw Blame History