# Snapshot / Soll-Zustand für agh-bf1 (TP23 Stufe 2) # ================================================= # Dies ist KEINE Transaktions-Akte (kein .json, keine change_id, kein expires) # und auch kein Vor-Zustand der heutigen Aenderung. Die Datei enthaelt die # vollstaendige AGH-Config mit bereits angewandtem Standortsuffix # (nas.bf.emsenhuber.net, pve-mcp.bf.emsenhuber.net, etc.) als Soll-Zustand # fuer den Bau des AGH-Paars (110/111) in der naechsten Session. # # Bezug: docs/handoff-20260826-tp31-suffix-sweep.md, Abschnitt # "Was als naechses ansteht" -> Schritt 2 (Rewrites mit Suffix setzen). # # Wichtige Felder zum Abgleich beim Bau: # - upstream_dns: bedingt auf /bf.emsenhuber.net/ (Suffix-Form, NICHT /bf.lan/) # - rewrites: 30 Eintraege; die 4 Public (vw/hass/n8n/gitea) bleiben ohne # Site-Suffix, die uebrigen 26 sind *.bf.emsenhuber.net (Caddy-Sites # auf .40 und BF-Hosts). Beim Bau der neuen Instanzen genauso setzen. http: pprof: port: 6060 enabled: false doh: routes: - GET /dns-query - POST /dns-query - GET /dns-query/{ClientID} - POST /dns-query/{ClientID} insecure_enabled: false address: 0.0.0.0:80 session_ttl: 30d users: - name: admin password: $2a$10$jTQHz3haJeD4a.P7nStyyefSdyx28L6oGV/73gVIYJSQzgRbbgS0. auth_attempts: 5 block_auth_min: 15 http_proxy: "" language: "" theme: auto dns: bind_hosts: - 0.0.0.0 port: 53 anonymize_client_ip: false ratelimit: 20 ratelimit_subnet_len_ipv4: 24 ratelimit_subnet_len_ipv6: 56 ratelimit_whitelist: [] refuse_any: true upstream_dns: - https://px35ynlol3.cloudflare-gateway.com/dns-query - '[/bf.emsenhuber.net/]10.40.20.1' - '[/40.10.in-addr.arpa/]10.40.20.1' upstream_dns_file: "" bootstrap_dns: - 1.1.1.1 - 1.0.0.1 fallback_dns: [] upstream_mode: load_balance fastest_timeout: 1s allowed_clients: [] disallowed_clients: [] blocked_hosts: - version.bind - id.server - hostname.bind trusted_proxies: - 127.0.0.0/8 - ::1/128 cache_enabled: true cache_size: 4194304 cache_ttl_min: 0 cache_ttl_max: 0 cache_optimistic: false cache_optimistic_answer_ttl: 30s cache_optimistic_max_age: 12h bogus_nxdomain: [] aaaa_disabled: false enable_dnssec: true edns_client_subnet: enabled: false use_custom: false max_goroutines: 300 handle_ddr: true ipset: [] ipset_file: "" bootstrap_prefer_ipv6: false upstream_timeout: 10s private_networks: [] use_private_ptr_resolvers: false local_ptr_upstreams: [] use_dns64: false dns64_prefixes: [] serve_http3: false use_http3_upstreams: false serve_plain_dns: true hostsfile_enabled: true pending_requests: enabled: true tls: enabled: false server_name: "" force_https: false port_https: 443 port_dns_over_tls: 853 port_dns_over_quic: 853 port_dnscrypt: 0 dnscrypt_config_file: "" certificate_chain: "" private_key: "" certificate_path: "" private_key_path: "" strict_sni_check: false querylog: interval: 90d size_memory: 1000 enabled: true ignored_enabled: false file_enabled: true statistics: interval: 1d enabled: true ignored_enabled: false filters: - enabled: true url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt name: AdGuard DNS filter id: 1 - enabled: false url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt name: AdAway Default Blocklist id: 2 whitelist_filters: [] user_rules: [] dhcp: enabled: false interface_name: "" local_domain_name: lan dhcpv4: gateway_ip: "" subnet_mask: "" range_start: "" range_end: "" lease_duration: 86400 icmp_timeout_msec: 1000 options: [] dhcpv6: range_start: "" lease_duration: 86400 ra_slaac_only: false ra_allow_slaac: false filtering: blocking_ipv4: "" blocking_ipv6: "" blocked_services: schedule: time_zone: UTC ids: [] protection_disabled_until: null safe_search: enabled: false blocking_mode: default parental_block_host: family-block.dns.adguard.com safebrowsing_block_host: standard-block.dns.adguard.com rewrites: - domain: vw.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: hass.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: n8n.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: gitea.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: nautobot.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: ds-bf.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: ccu.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: iobroker.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: z2m25.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: pve-mcp.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: ha-mcp.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: n8n-mcp.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: gitea-mcp.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: pve.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: portainer.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: pbs.emsenhuber.net answer: 10.40.20.40 enabled: true - domain: nas.bf.emsenhuber.net answer: 10.40.20.10 enabled: true - domain: macmini.bf.emsenhuber.net answer: 10.40.20.167 enabled: true - domain: mfc.bf.emsenhuber.net answer: 10.40.10.6 enabled: true - domain: tv.bf.emsenhuber.net answer: 10.40.40.11 enabled: true - domain: docker.bf.emsenhuber.net answer: 10.40.20.126 enabled: true - domain: platform-pg.bf.emsenhuber.net answer: 10.40.20.20 enabled: true - domain: pve-mcp.bf.emsenhuber.net answer: 10.40.20.173 enabled: true - domain: pve.bf.emsenhuber.net answer: 10.40.20.100 enabled: true - domain: core.bf.emsenhuber.net answer: 10.40.99.1 enabled: true - domain: ap1.bf.emsenhuber.net answer: 10.40.99.11 enabled: true - domain: ap2.bf.emsenhuber.net answer: 10.40.99.12 enabled: true - domain: branch.bf.emsenhuber.net answer: 10.40.99.2 enabled: true safe_fs_patterns: - /opt/AdGuardHome/data/userfilters/* max_http_size: 256MB safebrowsing_cache_size: 1048576 safesearch_cache_size: 1048576