admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

TP23 Stufe 4: AGH CIDR-Gruppen+Policy auf .36/.37 + Sync/Exception-Tooling

Browse Source 
- A0: API-User 'automation' auf agh-bf1/.36 + agh-bf2/.37 (PW in ~/.secrets, TP30-Merkposten)
- A: 8 clients.persistent (7 VLAN-CIDR-Gruppen + dns-bypass-exempt), Policy-Matrix
  (INFRA/MEDIA/MGMT filtering=aus, GUEST safe-search+parental an), live verifiziert
- B: agh-sync.py (check/push), Repo-SSoT AdGuardHome.yaml mit REDIGIERTEN Hashes
  (Alt-Hash-Exposure im Git entfernt); Invariante .36==.37 (AGH normalisiert beim Restart)
- C: agh-exception.py (allow-domain/unallow/unfilter/refilter/status) gegen beide
  Instanzen, end-to-end getestet; Contract in adguard/README.md
- Stufe 6 (Bypass-Sperre) NICHT geschaltet; kein DHCP-/Firewall-Write

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Christoph Emsenhuber
2026-09-04 21:19:50 +02:00
parent f8982df200
commit f507c50623
4 changed files with 502 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

291
adguard/AdGuardHome.yaml
View File

@@ -13,7 +13,9 @@ http:
session_ttl: 30d
users:
- name: admin
password: $2a$10$ue8PEedG4t2JRyT83XiGHeqIU4PFRzhn8rjDOZGYGt0sFC2qju2fi
password: '!on-device (siehe ~/.secrets + Gerät)'
- name: automation
password: '!on-device (siehe ~/.secrets + Gerät)'
auth_attempts: 5
block_auth_min: 15
http_proxy: ""
@@ -202,69 +204,9 @@ filtering:
- domain: gitea.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: nautobot.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: ds-bf.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: ccu.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: iobroker.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: z2m25.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: pve-mcp.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: ha-mcp.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: n8n-mcp.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: gitea-mcp.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: pve.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: portainer.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: pbs.emsenhuber.net
answer: 10.40.20.40
enabled: true
- domain: macmini.emsenhuber.net
answer: 10.40.20.167
enabled: true
- domain: mfc.emsenhuber.net
answer: 10.40.10.6
enabled: true
- domain: tv.emsenhuber.net
answer: 10.40.40.11
enabled: true
- domain: docker.emsenhuber.net
answer: 10.40.20.126
enabled: true
- domain: platform-pg.emsenhuber.net
answer: 10.40.20.20
enabled: true
- domain: core.emsenhuber.net
answer: 10.40.99.1
enabled: true
- domain: ap1.emsenhuber.net
answer: 10.40.99.11
enabled: true
- domain: ap2.emsenhuber.net
answer: 10.40.99.12
enabled: true
- domain: branch.emsenhuber.net
answer: 10.40.99.2
enabled: true
- domain: nas.bf.emsenhuber.net
answer: 10.40.20.10
enabled: true
@@ -316,7 +258,232 @@ clients:
rdns: true
dhcp: true
hosts: true
persistent: []
persistent:
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: dns-bypass-exempt
ids:
- 10.40.10.82
- 10.40.10.183
tags: []
upstreams: []
uid: 381d431a-1a43-41ea-adaa-2d67ada9aab0
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: false
filtering_enabled: false
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: true
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-guest
ids:
- 10.40.90.0/24
tags: []
upstreams: []
uid: af70dd86-43a9-4165-8228-26c7b90db5e6
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: false
filtering_enabled: true
parental_enabled: true
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-infra
ids:
- 10.40.20.0/24
tags: []
upstreams: []
uid: 78b2da82-1946-41ee-b386-b04eaee49bc3
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: false
filtering_enabled: false
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-iot
ids:
- 10.40.30.0/24
tags: []
upstreams: []
uid: 7a8ac674-4365-4b06-ad51-2516400903a1
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: true
filtering_enabled: true
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-main
ids:
- 10.40.10.0/24
tags: []
upstreams: []
uid: 39955cc1-6ec2-4cf6-a757-233672b9dc3d
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: true
filtering_enabled: true
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-media
ids:
- 10.40.40.0/24
tags: []
upstreams: []
uid: 44e4a1d7-d1b6-446c-a753-65e714ec93aa
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: false
filtering_enabled: false
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-mgmt
ids:
- 10.40.99.0/24
tags: []
upstreams: []
uid: 4c5eeafb-f7f2-4fb1-ab87-fd2a2366d57a
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: false
filtering_enabled: false
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
- safe_search:
enabled: false
bing: false
duckduckgo: false
ecosia: false
google: false
pixabay: false
yandex: false
youtube: false
blocked_services:
schedule:
time_zone: Local
ids: []
name: grp-untrusted
ids:
- 10.40.50.0/24
tags: []
upstreams: []
uid: 7f182498-7b82-4580-b1b0-0a2d46c205ef
upstreams_cache_size: 0
upstreams_cache_enabled: false
use_global_settings: true
filtering_enabled: true
parental_enabled: false
safebrowsing_enabled: false
use_global_blocked_services: true
ignore_querylog: false
ignore_statistics: false
log:
enabled: true
file: ""