http:
  pprof:
    port: 6060
    enabled: false
  doh:
    routes:
      - GET /dns-query
      - POST /dns-query
      - GET /dns-query/{ClientID}
      - POST /dns-query/{ClientID}
    insecure_enabled: false
  address: 0.0.0.0:80
  session_ttl: 30d
users:
  - name: admin
    password: '!on-device (siehe ~/.secrets + Gerät)'
  - name: automation
    password: '!on-device (siehe ~/.secrets + Gerät)'
auth_attempts: 5
block_auth_min: 15
http_proxy: ""
language: ""
theme: auto
dns:
  bind_hosts:
    - 0.0.0.0
  port: 53
  anonymize_client_ip: false
  ratelimit: 20
  ratelimit_subnet_len_ipv4: 24
  ratelimit_subnet_len_ipv6: 56
  ratelimit_whitelist: []
  refuse_any: true
  # TP45 C2 (2026-09-22): der Core ist der EINZIGE Upstream — AGH macht nur noch
  # Filtering. Die interne Zone und die bare Namen kommen damit aus derselben Quelle
  # wie fuer jeden anderen Client. DoH nach draussen macht allein der Core.
  upstream_dns:
    - 10.40.20.1
  upstream_dns_file: ""
  bootstrap_dns:
    - 1.1.1.1
    - 1.0.0.1
  fallback_dns: []
  upstream_mode: load_balance
  fastest_timeout: 1s
  allowed_clients: []
  disallowed_clients: []
  blocked_hosts:
    - version.bind
    - id.server
    - hostname.bind
  trusted_proxies:
    - 127.0.0.0/8
    - ::1/128
  cache_enabled: true
  cache_size: 4194304
  cache_ttl_min: 0
  cache_ttl_max: 0
  cache_optimistic: false
  cache_optimistic_answer_ttl: 30s
  cache_optimistic_max_age: 12h
  bogus_nxdomain: []
  aaaa_disabled: false
  enable_dnssec: true
  edns_client_subnet:
    custom_ip: ""
    enabled: false
    use_custom: false
  max_goroutines: 300
  handle_ddr: true
  ipset: []
  ipset_file: ""
  bootstrap_prefer_ipv6: false
  upstream_timeout: 10s
  private_networks: []
  use_private_ptr_resolvers: true
  local_ptr_upstreams: []
  use_dns64: false
  dns64_prefixes: []
  serve_http3: false
  use_http3_upstreams: false
  serve_plain_dns: true
  hostsfile_enabled: true
  pending_requests:
    enabled: true
tls:
  enabled: false
  server_name: ""
  force_https: false
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 853
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  certificate_chain: ""
  private_key: ""
  certificate_path: ""
  private_key_path: ""
  strict_sni_check: false
querylog:
  dir_path: ""
  ignored: []
  interval: 90d
  size_memory: 1000
  enabled: true
  ignored_enabled: false
  file_enabled: true
statistics:
  dir_path: ""
  ignored: []
  interval: 1d
  enabled: true
  ignored_enabled: false
filters:
  - enabled: true
    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
    name: AdGuard DNS filter
    id: 1
  - enabled: false
    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
    name: AdAway Default Blocklist
    id: 2
whitelist_filters: []
user_rules: []
dhcp:
  enabled: false
  interface_name: ""
  local_domain_name: lan
  dhcpv4:
    gateway_ip: ""
    subnet_mask: ""
    range_start: ""
    range_end: ""
    lease_duration: 86400
    icmp_timeout_msec: 1000
    options: []
  dhcpv6:
    range_start: ""
    lease_duration: 86400
    ra_slaac_only: false
    ra_allow_slaac: false
filtering:
  blocking_ipv4: ""
  blocking_ipv6: ""
  blocked_services:
    schedule:
      time_zone: Local
    ids: []
  protection_disabled_until: null
  safe_search:
    enabled: false
    bing: true
    duckduckgo: true
    ecosia: true
    google: true
    pixabay: true
    yandex: true
    youtube: true
  blocking_mode: default
  parental_block_host: family-block.dns.adguard.com
  safebrowsing_block_host: standard-block.dns.adguard.com
  # TP45 C2 (2026-09-22): alle 26 Rewrites entfernt — sie waren die zweite, stille
  # Definitionsquelle. Der Core haelt jeden dieser Namen als /ip dns static.
  rewrites: []
  safe_fs_patterns:
    - /opt/AdGuardHome/userfilters/*
  max_http_size: 256MB
  safebrowsing_cache_size: 1048576
  safesearch_cache_size: 1048576
  parental_cache_size: 1048576
  cache_time: 30
  filters_update_interval: 24
  blocked_response_ttl: 10
  filtering_enabled: true
  rewrites_enabled: true
  parental_enabled: false
  safebrowsing_enabled: false
  protection_enabled: true
clients:
  runtime_sources:
    whois: true
    arp: true
    rdns: true
    dhcp: true
    hosts: true
  persistent:
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: dns-bypass-exempt
      ids:
        - 10.40.10.82
        - 10.40.10.183
      tags: []
      upstreams: []
      uid: 381d431a-1a43-41ea-adaa-2d67ada9aab0
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: false
      filtering_enabled: false
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: true
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-guest
      ids:
        - 10.40.90.0/24
      tags: []
      upstreams: []
      uid: af70dd86-43a9-4165-8228-26c7b90db5e6
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: false
      filtering_enabled: true
      parental_enabled: true
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-infra
      ids:
        - 10.40.20.0/24
      tags: []
      upstreams: []
      uid: 78b2da82-1946-41ee-b386-b04eaee49bc3
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: false
      filtering_enabled: false
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-iot
      ids:
        - 10.40.30.0/24
      tags: []
      upstreams: []
      uid: 7a8ac674-4365-4b06-ad51-2516400903a1
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: true
      filtering_enabled: true
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-main
      ids:
        - 10.40.10.0/24
      tags: []
      upstreams: []
      uid: 39955cc1-6ec2-4cf6-a757-233672b9dc3d
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: true
      filtering_enabled: true
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-media
      ids:
        - 10.40.40.0/24
      tags: []
      upstreams: []
      uid: 44e4a1d7-d1b6-446c-a753-65e714ec93aa
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: false
      filtering_enabled: false
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-mgmt
      ids:
        - 10.40.99.0/24
      tags: []
      upstreams: []
      uid: 4c5eeafb-f7f2-4fb1-ab87-fd2a2366d57a
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: false
      filtering_enabled: false
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
    - safe_search:
        enabled: false
        bing: false
        duckduckgo: false
        ecosia: false
        google: false
        pixabay: false
        yandex: false
        youtube: false
      blocked_services:
        schedule:
          time_zone: Local
        ids: []
      name: grp-untrusted
      ids:
        - 10.40.50.0/24
      tags: []
      upstreams: []
      uid: 7f182498-7b82-4580-b1b0-0a2d46c205ef
      upstreams_cache_size: 0
      upstreams_cache_enabled: false
      use_global_settings: true
      filtering_enabled: true
      parental_enabled: false
      safebrowsing_enabled: false
      use_global_blocked_services: true
      ignore_querylog: false
      ignore_statistics: false
log:
  enabled: true
  file: ""
  max_backups: 0
  max_size: 100
  max_age: 3
  compress: false
  local_time: false
  verbose: false
os:
  group: ""
  user: ""
  rlimit_nofile: 0
schema_version: 34