admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

TP23 Stufe 2: AGH-Paar als DNS-Resolver + DHCP auf emsenhuber.net

Browse Source 
- adguard/AdGuardHome.yaml: AGH-Wizard-Setup (27 Rewrites ohne .bf, DoH zum CF-Gateway, conditional emsenhuber.net).
- nautobot/mikrotik_routeros.j2: DHCP dns-server=10.40.20.36,.37, domain=emsenhuber.net.
- docs/transaktionen/TP23-agh-firewall.commands.rsc: TP5-E2 LAN->AGH dns auf .16/.17 ersetzt durch .36/.37.
- docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc: DHCP-Cutover (dns-server + domain in einem Deploy).

Compliance 104/104, 0 Drifts. Core bleibt als Rückfallebene unangetastet.

[KEIN go fuer den Rest: Persistenz (CLAUDE.md/memory), Host.Naming (.host.emsenhuber.net),
add-dns-entries-Suffix, conditional-Upstream, lease-time-Transaktion, TP31-defer — alles im Plan,
Wartet auf separates go des Users.]
This commit is contained in:
Christoph Emsenhuber
2026-08-26 20:26:41 +02:00
parent 04abb5a620
commit 535a3bd7b9
4 changed files with 289 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc Normal file
View File

@@ -0,0 +1,8 @@
/ip dhcp-server network set [find address~"10.40.10.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.20.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.30.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.40.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.50.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.90.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
/ip dhcp-server network set [find address~"10.40.99.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
:log info ("agh-cutover: dns-server=" . [/ip dhcp-server network get [find address~"10.40.10.0"] dns-server] . " domain=" . [/ip dhcp-server network get [find address~"10.40.10.0"] domain])

7
docs/transaktionen/TP23-agh-firewall.commands.rsc Normal file
View File

@@ -0,0 +1,7 @@
:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns (Vorrat)"] } on-error={ :log info "agh: remove udp .16 hat geworfen" }
:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns-tcp (Vorrat)"] } on-error={ :log info "agh: remove tcp .16 hat geworfen" }
/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.36 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.36 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.37 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.37 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
:log info ("agh: rest .16=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.16]]] . " neu .36/.37=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.36]]] . "/" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.37]]])