TP23 Stufe 2: AGH-Paar als DNS-Resolver + DHCP auf emsenhuber.net

- adguard/AdGuardHome.yaml: AGH-Wizard-Setup (27 Rewrites ohne .bf, DoH zum CF-Gateway, conditional emsenhuber.net).
- nautobot/mikrotik_routeros.j2: DHCP dns-server=10.40.20.36,.37, domain=emsenhuber.net.
- docs/transaktionen/TP23-agh-firewall.commands.rsc: TP5-E2 LAN->AGH dns auf .16/.17 ersetzt durch .36/.37.
- docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc: DHCP-Cutover (dns-server + domain in einem Deploy).

Compliance 104/104, 0 Drifts. Core bleibt als Rückfallebene unangetastet.

[KEIN go fuer den Rest: Persistenz (CLAUDE.md/memory), Host.Naming (.host.emsenhuber.net),
add-dns-entries-Suffix, conditional-Upstream, lease-time-Transaktion, TP31-defer — alles im Plan,
Wartet auf separates go des Users.]

adguard/AdGuardHome.yaml

@@ -0,0 +1,273 @@
+http:
+  pprof:
+    port: 6060
+    enabled: false
+  doh:
+    routes:
+      - GET /dns-query
+      - POST /dns-query
+      - GET /dns-query/{ClientID}
+      - POST /dns-query/{ClientID}
+    insecure_enabled: false
+  address: 0.0.0.0:80
+  session_ttl: 30d
+users:
+  - name: admin
+    password: $2a$10$ue8PEedG4t2JRyT83XiGHeqIU4PFRzhn8rjDOZGYGt0sFC2qju2fi
+auth_attempts: 5
+block_auth_min: 15
+http_proxy: ""
+language: ""
+theme: auto
+dns:
+  bind_hosts:
+    - 0.0.0.0
+  port: 53
+  anonymize_client_ip: false
+  ratelimit: 20
+  ratelimit_subnet_len_ipv4: 24
+  ratelimit_subnet_len_ipv6: 56
+  ratelimit_whitelist: []
+  refuse_any: true
+  upstream_dns:
+    - https://px35ynlol3.cloudflare-gateway.com/dns-query
+    - '[/bf.lan/]10.40.20.1'
+    - '[/40.10.in-addr.arpa/]10.40.20.1'
+  upstream_dns_file: ""
+  bootstrap_dns:
+    - 1.1.1.1
+    - 1.0.0.1
+  fallback_dns: []
+  upstream_mode: load_balance
+  fastest_timeout: 1s
+  allowed_clients: []
+  disallowed_clients: []
+  blocked_hosts:
+    - version.bind
+    - id.server
+    - hostname.bind
+  trusted_proxies:
+    - 127.0.0.0/8
+    - ::1/128
+  cache_enabled: true
+  cache_size: 4194304
+  cache_ttl_min: 0
+  cache_ttl_max: 0
+  cache_optimistic: false
+  cache_optimistic_answer_ttl: 30s
+  cache_optimistic_max_age: 12h
+  bogus_nxdomain: []
+  aaaa_disabled: false
+  enable_dnssec: true
+  edns_client_subnet:
+    custom_ip: ""
+    enabled: false
+    use_custom: false
+  max_goroutines: 300
+  handle_ddr: true
+  ipset: []
+  ipset_file: ""
+  bootstrap_prefer_ipv6: false
+  upstream_timeout: 10s
+  private_networks: []
+  use_private_ptr_resolvers: true
+  local_ptr_upstreams: []
+  use_dns64: false
+  dns64_prefixes: []
+  serve_http3: false
+  use_http3_upstreams: false
+  serve_plain_dns: true
+  hostsfile_enabled: true
+  pending_requests:
+    enabled: true
+tls:
+  enabled: false
+  server_name: ""
+  force_https: false
+  port_https: 443
+  port_dns_over_tls: 853
+  port_dns_over_quic: 853
+  port_dnscrypt: 0
+  dnscrypt_config_file: ""
+  certificate_chain: ""
+  private_key: ""
+  certificate_path: ""
+  private_key_path: ""
+  strict_sni_check: false
+querylog:
+  dir_path: ""
+  ignored: []
+  interval: 90d
+  size_memory: 1000
+  enabled: true
+  ignored_enabled: false
+  file_enabled: true
+statistics:
+  dir_path: ""
+  ignored: []
+  interval: 1d
+  enabled: true
+  ignored_enabled: false
+filters:
+  - enabled: true
+    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
+    name: AdGuard DNS filter
+    id: 1
+  - enabled: false
+    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
+    name: AdAway Default Blocklist
+    id: 2
+whitelist_filters: []
+user_rules: []
+dhcp:
+  enabled: false
+  interface_name: ""
+  local_domain_name: lan
+  dhcpv4:
+    gateway_ip: ""
+    subnet_mask: ""
+    range_start: ""
+    range_end: ""
+    lease_duration: 86400
+    icmp_timeout_msec: 1000
+    options: []
+  dhcpv6:
+    range_start: ""
+    lease_duration: 86400
+    ra_slaac_only: false
+    ra_allow_slaac: false
+filtering:
+  blocking_ipv4: ""
+  blocking_ipv6: ""
+  blocked_services:
+    schedule:
+      time_zone: Local
+    ids: []
+  protection_disabled_until: null
+  safe_search:
+    enabled: false
+    bing: true
+    duckduckgo: true
+    ecosia: true
+    google: true
+    pixabay: true
+    yandex: true
+    youtube: true
+  blocking_mode: default
+  parental_block_host: family-block.dns.adguard.com
+  safebrowsing_block_host: standard-block.dns.adguard.com
+  rewrites:
+    - domain: vw.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: hass.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: n8n.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: gitea.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: nautobot.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: ds-bf.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: ccu.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: iobroker.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: z2m25.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: pve-mcp.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: ha-mcp.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: n8n-mcp.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: gitea-mcp.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: pve.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: portainer.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: pbs.emsenhuber.net
+      answer: 10.40.20.40
+      enabled: true
+    - domain: nas.emsenhuber.net
+      answer: 10.40.20.10
+      enabled: true
+    - domain: macmini.emsenhuber.net
+      answer: 10.40.20.167
+      enabled: true
+    - domain: mfc.emsenhuber.net
+      answer: 10.40.10.6
+      enabled: true
+    - domain: tv.emsenhuber.net
+      answer: 10.40.40.11
+      enabled: true
+    - domain: docker.emsenhuber.net
+      answer: 10.40.20.126
+      enabled: true
+    - domain: platform-pg.emsenhuber.net
+      answer: 10.40.20.20
+      enabled: true
+    - domain: core.emsenhuber.net
+      answer: 10.40.99.1
+      enabled: true
+    - domain: ap1.emsenhuber.net
+      answer: 10.40.99.11
+      enabled: true
+    - domain: ap2.emsenhuber.net
+      answer: 10.40.99.12
+      enabled: true
+    - domain: branch.emsenhuber.net
+      answer: 10.40.99.2
+      enabled: true
+  safe_fs_patterns:
+    - /opt/AdGuardHome/userfilters/*
+  max_http_size: 256MB
+  safebrowsing_cache_size: 1048576
+  safesearch_cache_size: 1048576
+  parental_cache_size: 1048576
+  cache_time: 30
+  filters_update_interval: 24
+  blocked_response_ttl: 10
+  filtering_enabled: true
+  rewrites_enabled: true
+  parental_enabled: false
+  safebrowsing_enabled: false
+  protection_enabled: true
+clients:
+  runtime_sources:
+    whois: true
+    arp: true
+    rdns: true
+    dhcp: true
+    hosts: true
+  persistent: []
+log:
+  enabled: true
+  file: ""
+  max_backups: 0
+  max_size: 100
+  max_age: 3
+  compress: false
+  local_time: false
+  verbose: false
+os:
+  group: ""
+  user: ""
+  rlimit_nofile: 0
+schema_version: 34

docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc

@@ -0,0 +1,8 @@
+/ip dhcp-server network set [find address~"10.40.10.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.20.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.30.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.40.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.50.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.90.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+/ip dhcp-server network set [find address~"10.40.99.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net
+:log info ("agh-cutover: dns-server=" . [/ip dhcp-server network get [find address~"10.40.10.0"] dns-server] . " domain=" . [/ip dhcp-server network get [find address~"10.40.10.0"] domain])

docs/transaktionen/TP23-agh-firewall.commands.rsc

@@ -0,0 +1,7 @@
+:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns (Vorrat)"] } on-error={ :log info "agh: remove udp .16 hat geworfen" }
+:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns-tcp (Vorrat)"] } on-error={ :log info "agh: remove tcp .16 hat geworfen" }
+/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.36 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
+/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.36 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
+/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.37 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
+/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.37 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"]
+:log info ("agh: rest .16=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.16]]] . " neu .36/.37=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.36]]] . "/" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.37]]])

nautobot/mikrotik_routeros.j2

@@ -127,7 +127,7 @@
 /ip dhcp-server add address-pool=pool-v{{ v.id }} comment={{ v.name }} interface=vlan{{ v.id }} lease-time={{ v.lease }} name=dhcp-v{{ v.id }}
 {% endfor %}
 {% for v in vlans %}
-/ip dhcp-server network add address=10.40.{{ v.id }}.0/24 dns-server=10.40.{{ v.id }}.1 domain=bf.lan gateway=10.40.{{ v.id }}.1 ntp-server=10.40.{{ v.id }}.1
+/ip dhcp-server network add address=10.40.{{ v.id }}.0/24 dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net gateway=10.40.{{ v.id }}.1 ntp-server=10.40.{{ v.id }}.1
 {% endfor %}
 /ip dhcp-server option add code=6 name="dns 1.1.1.1" value=0x01010101