TP23 Stufe 2 + TP31 Schritt 4: AdGuard split-horizon mit .bf.-Suffix, Caddyfile .bf.-FQDNs

- AGH 110/111: conditional upstream [/bf.emsenhuber.net/]10.40.20.1
- 47 Rewrites: 16 Service->Caddy (inkl. .bf.), 10 Hosts mit .bf., suffixlose parallel
- Caddyfile: interne Sites mit .bf.-Alias (public vw/hass/n8n/gitea ohne)
- DHCP: alle 7 VLANs zeigen auf .36/.37 (domain=emsenhuber.net)
- Firewall-Regeln auf .36/.37 bereits scharf
- nas.emsenhuber.net endgueltig entfernt (war schon in 1d569fa)
- Ist-Stand-Block + Status-Tabelle nachgezogen

adguard/AdGuardHome.yaml

@@ -31,7 +31,7 @@ dns:
   refuse_any: true
   upstream_dns:
     - https://px35ynlol3.cloudflare-gateway.com/dns-query
-    - '[/bf.lan/]10.40.20.1'
+    - '[/bf.emsenhuber.net/]10.40.20.1'
     - '[/40.10.in-addr.arpa/]10.40.20.1'
   upstream_dns_file: ""
   bootstrap_dns:
@@ -157,6 +157,39 @@ filtering:
   parental_block_host: family-block.dns.adguard.com
   safebrowsing_block_host: standard-block.dns.adguard.com
   rewrites:
+    - domain: pbs.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: portainer.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: pve.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: gitea-mcp.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: n8n-mcp.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: ha-mcp.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: pve-mcp.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: z2m25.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: iobroker.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: ccu.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: nautobot.bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
     - domain: vw.emsenhuber.net
       answer: 10.40.20.40
       enabled: true
@@ -232,6 +265,36 @@ filtering:
     - domain: branch.emsenhuber.net
       answer: 10.40.99.2
       enabled: true
+    - domain: nas.bf.emsenhuber.net
+      answer: 10.40.20.10
+      enabled: true
+    - domain: macmini.bf.emsenhuber.net
+      answer: 10.40.20.167
+      enabled: true
+    - domain: mfc.bf.emsenhuber.net
+      answer: 10.40.10.6
+      enabled: true
+    - domain: tv.bf.emsenhuber.net
+      answer: 10.40.40.11
+      enabled: true
+    - domain: docker.bf.emsenhuber.net
+      answer: 10.40.20.126
+      enabled: true
+    - domain: platform-pg.bf.emsenhuber.net
+      answer: 10.40.20.20
+      enabled: true
+    - domain: core.bf.emsenhuber.net
+      answer: 10.40.99.1
+      enabled: true
+    - domain: ap1.bf.emsenhuber.net
+      answer: 10.40.99.11
+      enabled: true
+    - domain: ap2.bf.emsenhuber.net
+      answer: 10.40.99.12
+      enabled: true
+    - domain: branch.bf.emsenhuber.net
+      answer: 10.40.99.2
+      enabled: true
   safe_fs_patterns:
     - /opt/AdGuardHome/userfilters/*
   max_http_size: 256MB