transaktionen: agh-bf1-AdGuardHome als Soll-Zustand fuer TP23 Stufe 2
Die Datei war bereits im Working Tree, aber ohne klaren Zweck -- jetzt umbenannt auf .snapshot.yaml und mit Marker-Kommentar versehen, der sagt: - das ist KEINE Transaktions-Akte (kein .json) - das ist auch KEIN Vor-Zustand zum heutigen nas.emsenhuber.net-Edit - das ist die AGH-Komplett-Config mit bereits angewandtem Standortsuffix (*.bf.emsenhuber.net), die beim Bau des AGH-Paars (110/111) in der naechsten Session als Soll-Zustand gilt. upstream_dns ist auf /bf.emsenhuber.net/ bedingt (Suffix-Form), 26 von 30 Rewrites haben .bf.-Suffix, 4 Public (vw/hass/n8n/gitea) bleiben ohne Suffix.
This commit is contained in:
252
docs/transaktionen/agh-bf1-AdGuardHome.snapshot.yaml
Normal file
252
docs/transaktionen/agh-bf1-AdGuardHome.snapshot.yaml
Normal file
@@ -0,0 +1,252 @@
|
||||
# Snapshot / Soll-Zustand für agh-bf1 (TP23 Stufe 2)
|
||||
# =================================================
|
||||
# Dies ist KEINE Transaktions-Akte (kein .json, keine change_id, kein expires)
|
||||
# und auch kein Vor-Zustand der heutigen Aenderung. Die Datei enthaelt die
|
||||
# vollstaendige AGH-Config mit bereits angewandtem Standortsuffix
|
||||
# (nas.bf.emsenhuber.net, pve-mcp.bf.emsenhuber.net, etc.) als Soll-Zustand
|
||||
# fuer den Bau des AGH-Paars (110/111) in der naechsten Session.
|
||||
#
|
||||
# Bezug: docs/handoff-20260826-tp31-suffix-sweep.md, Abschnitt
|
||||
# "Was als naechses ansteht" -> Schritt 2 (Rewrites mit Suffix setzen).
|
||||
#
|
||||
# Wichtige Felder zum Abgleich beim Bau:
|
||||
# - upstream_dns: bedingt auf /bf.emsenhuber.net/ (Suffix-Form, NICHT /bf.lan/)
|
||||
# - rewrites: 30 Eintraege; die 4 Public (vw/hass/n8n/gitea) bleiben ohne
|
||||
# Site-Suffix, die uebrigen 26 sind *.bf.emsenhuber.net (Caddy-Sites
|
||||
# auf .40 und BF-Hosts). Beim Bau der neuen Instanzen genauso setzen.
|
||||
http:
|
||||
pprof:
|
||||
port: 6060
|
||||
enabled: false
|
||||
doh:
|
||||
routes:
|
||||
- GET /dns-query
|
||||
- POST /dns-query
|
||||
- GET /dns-query/{ClientID}
|
||||
- POST /dns-query/{ClientID}
|
||||
insecure_enabled: false
|
||||
address: 0.0.0.0:80
|
||||
session_ttl: 30d
|
||||
users:
|
||||
- name: admin
|
||||
password: $2a$10$jTQHz3haJeD4a.P7nStyyefSdyx28L6oGV/73gVIYJSQzgRbbgS0.
|
||||
auth_attempts: 5
|
||||
block_auth_min: 15
|
||||
http_proxy: ""
|
||||
language: ""
|
||||
theme: auto
|
||||
dns:
|
||||
bind_hosts:
|
||||
- 0.0.0.0
|
||||
port: 53
|
||||
anonymize_client_ip: false
|
||||
ratelimit: 20
|
||||
ratelimit_subnet_len_ipv4: 24
|
||||
ratelimit_subnet_len_ipv6: 56
|
||||
ratelimit_whitelist: []
|
||||
refuse_any: true
|
||||
upstream_dns:
|
||||
- https://px35ynlol3.cloudflare-gateway.com/dns-query
|
||||
- '[/bf.emsenhuber.net/]10.40.20.1'
|
||||
- '[/40.10.in-addr.arpa/]10.40.20.1'
|
||||
upstream_dns_file: ""
|
||||
bootstrap_dns:
|
||||
- 1.1.1.1
|
||||
- 1.0.0.1
|
||||
fallback_dns: []
|
||||
upstream_mode: load_balance
|
||||
fastest_timeout: 1s
|
||||
allowed_clients: []
|
||||
disallowed_clients: []
|
||||
blocked_hosts:
|
||||
- version.bind
|
||||
- id.server
|
||||
- hostname.bind
|
||||
trusted_proxies:
|
||||
- 127.0.0.0/8
|
||||
- ::1/128
|
||||
cache_enabled: true
|
||||
cache_size: 4194304
|
||||
cache_ttl_min: 0
|
||||
cache_ttl_max: 0
|
||||
cache_optimistic: false
|
||||
cache_optimistic_answer_ttl: 30s
|
||||
cache_optimistic_max_age: 12h
|
||||
bogus_nxdomain: []
|
||||
aaaa_disabled: false
|
||||
enable_dnssec: true
|
||||
edns_client_subnet:
|
||||
enabled: false
|
||||
use_custom: false
|
||||
max_goroutines: 300
|
||||
handle_ddr: true
|
||||
ipset: []
|
||||
ipset_file: ""
|
||||
bootstrap_prefer_ipv6: false
|
||||
upstream_timeout: 10s
|
||||
private_networks: []
|
||||
use_private_ptr_resolvers: false
|
||||
local_ptr_upstreams: []
|
||||
use_dns64: false
|
||||
dns64_prefixes: []
|
||||
serve_http3: false
|
||||
use_http3_upstreams: false
|
||||
serve_plain_dns: true
|
||||
hostsfile_enabled: true
|
||||
pending_requests:
|
||||
enabled: true
|
||||
tls:
|
||||
enabled: false
|
||||
server_name: ""
|
||||
force_https: false
|
||||
port_https: 443
|
||||
port_dns_over_tls: 853
|
||||
port_dns_over_quic: 853
|
||||
port_dnscrypt: 0
|
||||
dnscrypt_config_file: ""
|
||||
certificate_chain: ""
|
||||
private_key: ""
|
||||
certificate_path: ""
|
||||
private_key_path: ""
|
||||
strict_sni_check: false
|
||||
querylog:
|
||||
interval: 90d
|
||||
size_memory: 1000
|
||||
enabled: true
|
||||
ignored_enabled: false
|
||||
file_enabled: true
|
||||
statistics:
|
||||
interval: 1d
|
||||
enabled: true
|
||||
ignored_enabled: false
|
||||
filters:
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
|
||||
name: AdGuard DNS filter
|
||||
id: 1
|
||||
- enabled: false
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
|
||||
name: AdAway Default Blocklist
|
||||
id: 2
|
||||
whitelist_filters: []
|
||||
user_rules: []
|
||||
dhcp:
|
||||
enabled: false
|
||||
interface_name: ""
|
||||
local_domain_name: lan
|
||||
dhcpv4:
|
||||
gateway_ip: ""
|
||||
subnet_mask: ""
|
||||
range_start: ""
|
||||
range_end: ""
|
||||
lease_duration: 86400
|
||||
icmp_timeout_msec: 1000
|
||||
options: []
|
||||
dhcpv6:
|
||||
range_start: ""
|
||||
lease_duration: 86400
|
||||
ra_slaac_only: false
|
||||
ra_allow_slaac: false
|
||||
filtering:
|
||||
blocking_ipv4: ""
|
||||
blocking_ipv6: ""
|
||||
blocked_services:
|
||||
schedule:
|
||||
time_zone: UTC
|
||||
ids: []
|
||||
protection_disabled_until: null
|
||||
safe_search:
|
||||
enabled: false
|
||||
blocking_mode: default
|
||||
parental_block_host: family-block.dns.adguard.com
|
||||
safebrowsing_block_host: standard-block.dns.adguard.com
|
||||
rewrites:
|
||||
- domain: vw.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: hass.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: n8n.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: gitea.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: nautobot.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: ds-bf.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: ccu.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: iobroker.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: z2m25.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: pve-mcp.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: ha-mcp.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: n8n-mcp.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: gitea-mcp.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: pve.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: portainer.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: pbs.emsenhuber.net
|
||||
answer: 10.40.20.40
|
||||
enabled: true
|
||||
- domain: nas.bf.emsenhuber.net
|
||||
answer: 10.40.20.10
|
||||
enabled: true
|
||||
- domain: macmini.bf.emsenhuber.net
|
||||
answer: 10.40.20.167
|
||||
enabled: true
|
||||
- domain: mfc.bf.emsenhuber.net
|
||||
answer: 10.40.10.6
|
||||
enabled: true
|
||||
- domain: tv.bf.emsenhuber.net
|
||||
answer: 10.40.40.11
|
||||
enabled: true
|
||||
- domain: docker.bf.emsenhuber.net
|
||||
answer: 10.40.20.126
|
||||
enabled: true
|
||||
- domain: platform-pg.bf.emsenhuber.net
|
||||
answer: 10.40.20.20
|
||||
enabled: true
|
||||
- domain: pve-mcp.bf.emsenhuber.net
|
||||
answer: 10.40.20.173
|
||||
enabled: true
|
||||
- domain: pve.bf.emsenhuber.net
|
||||
answer: 10.40.20.100
|
||||
enabled: true
|
||||
- domain: core.bf.emsenhuber.net
|
||||
answer: 10.40.99.1
|
||||
enabled: true
|
||||
- domain: ap1.bf.emsenhuber.net
|
||||
answer: 10.40.99.11
|
||||
enabled: true
|
||||
- domain: ap2.bf.emsenhuber.net
|
||||
answer: 10.40.99.12
|
||||
enabled: true
|
||||
- domain: branch.bf.emsenhuber.net
|
||||
answer: 10.40.99.2
|
||||
enabled: true
|
||||
safe_fs_patterns:
|
||||
- /opt/AdGuardHome/data/userfilters/*
|
||||
max_http_size: 256MB
|
||||
safebrowsing_cache_size: 1048576
|
||||
safesearch_cache_size: 1048576
|
||||
Reference in New Issue
Block a user