Christoph Emsenhuber
f507c50623
- A0: API-User 'automation' auf agh-bf1/.36 + agh-bf2/.37 (PW in ~/.secrets, TP30-Merkposten) - A: 8 clients.persistent (7 VLAN-CIDR-Gruppen + dns-bypass-exempt), Policy-Matrix (INFRA/MEDIA/MGMT filtering=aus, GUEST safe-search+parental an), live verifiziert - B: agh-sync.py (check/push), Repo-SSoT AdGuardHome.yaml mit REDIGIERTEN Hashes (Alt-Hash-Exposure im Git entfernt); Invariante .36==.37 (AGH normalisiert beim Restart) - C: agh-exception.py (allow-domain/unallow/unfilter/refilter/status) gegen beide Instanzen, end-to-end getestet; Contract in adguard/README.md - Stufe 6 (Bypass-Sperre) NICHT geschaltet; kein DHCP-/Firewall-Write Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
501 lines
12 KiB
YAML
501 lines
12 KiB
YAML
http:
|
|
pprof:
|
|
port: 6060
|
|
enabled: false
|
|
doh:
|
|
routes:
|
|
- GET /dns-query
|
|
- POST /dns-query
|
|
- GET /dns-query/{ClientID}
|
|
- POST /dns-query/{ClientID}
|
|
insecure_enabled: false
|
|
address: 0.0.0.0:80
|
|
session_ttl: 30d
|
|
users:
|
|
- name: admin
|
|
password: '!on-device (siehe ~/.secrets + Gerät)'
|
|
- name: automation
|
|
password: '!on-device (siehe ~/.secrets + Gerät)'
|
|
auth_attempts: 5
|
|
block_auth_min: 15
|
|
http_proxy: ""
|
|
language: ""
|
|
theme: auto
|
|
dns:
|
|
bind_hosts:
|
|
- 0.0.0.0
|
|
port: 53
|
|
anonymize_client_ip: false
|
|
ratelimit: 20
|
|
ratelimit_subnet_len_ipv4: 24
|
|
ratelimit_subnet_len_ipv6: 56
|
|
ratelimit_whitelist: []
|
|
refuse_any: true
|
|
upstream_dns:
|
|
- https://px35ynlol3.cloudflare-gateway.com/dns-query
|
|
- '[/bf.emsenhuber.net/]10.40.20.1'
|
|
- '[/40.10.in-addr.arpa/]10.40.20.1'
|
|
upstream_dns_file: ""
|
|
bootstrap_dns:
|
|
- 1.1.1.1
|
|
- 1.0.0.1
|
|
fallback_dns: []
|
|
upstream_mode: load_balance
|
|
fastest_timeout: 1s
|
|
allowed_clients: []
|
|
disallowed_clients: []
|
|
blocked_hosts:
|
|
- version.bind
|
|
- id.server
|
|
- hostname.bind
|
|
trusted_proxies:
|
|
- 127.0.0.0/8
|
|
- ::1/128
|
|
cache_enabled: true
|
|
cache_size: 4194304
|
|
cache_ttl_min: 0
|
|
cache_ttl_max: 0
|
|
cache_optimistic: false
|
|
cache_optimistic_answer_ttl: 30s
|
|
cache_optimistic_max_age: 12h
|
|
bogus_nxdomain: []
|
|
aaaa_disabled: false
|
|
enable_dnssec: true
|
|
edns_client_subnet:
|
|
custom_ip: ""
|
|
enabled: false
|
|
use_custom: false
|
|
max_goroutines: 300
|
|
handle_ddr: true
|
|
ipset: []
|
|
ipset_file: ""
|
|
bootstrap_prefer_ipv6: false
|
|
upstream_timeout: 10s
|
|
private_networks: []
|
|
use_private_ptr_resolvers: true
|
|
local_ptr_upstreams: []
|
|
use_dns64: false
|
|
dns64_prefixes: []
|
|
serve_http3: false
|
|
use_http3_upstreams: false
|
|
serve_plain_dns: true
|
|
hostsfile_enabled: true
|
|
pending_requests:
|
|
enabled: true
|
|
tls:
|
|
enabled: false
|
|
server_name: ""
|
|
force_https: false
|
|
port_https: 443
|
|
port_dns_over_tls: 853
|
|
port_dns_over_quic: 853
|
|
port_dnscrypt: 0
|
|
dnscrypt_config_file: ""
|
|
certificate_chain: ""
|
|
private_key: ""
|
|
certificate_path: ""
|
|
private_key_path: ""
|
|
strict_sni_check: false
|
|
querylog:
|
|
dir_path: ""
|
|
ignored: []
|
|
interval: 90d
|
|
size_memory: 1000
|
|
enabled: true
|
|
ignored_enabled: false
|
|
file_enabled: true
|
|
statistics:
|
|
dir_path: ""
|
|
ignored: []
|
|
interval: 1d
|
|
enabled: true
|
|
ignored_enabled: false
|
|
filters:
|
|
- enabled: true
|
|
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
|
|
name: AdGuard DNS filter
|
|
id: 1
|
|
- enabled: false
|
|
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
|
|
name: AdAway Default Blocklist
|
|
id: 2
|
|
whitelist_filters: []
|
|
user_rules: []
|
|
dhcp:
|
|
enabled: false
|
|
interface_name: ""
|
|
local_domain_name: lan
|
|
dhcpv4:
|
|
gateway_ip: ""
|
|
subnet_mask: ""
|
|
range_start: ""
|
|
range_end: ""
|
|
lease_duration: 86400
|
|
icmp_timeout_msec: 1000
|
|
options: []
|
|
dhcpv6:
|
|
range_start: ""
|
|
lease_duration: 86400
|
|
ra_slaac_only: false
|
|
ra_allow_slaac: false
|
|
filtering:
|
|
blocking_ipv4: ""
|
|
blocking_ipv6: ""
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
protection_disabled_until: null
|
|
safe_search:
|
|
enabled: false
|
|
bing: true
|
|
duckduckgo: true
|
|
ecosia: true
|
|
google: true
|
|
pixabay: true
|
|
yandex: true
|
|
youtube: true
|
|
blocking_mode: default
|
|
parental_block_host: family-block.dns.adguard.com
|
|
safebrowsing_block_host: standard-block.dns.adguard.com
|
|
rewrites:
|
|
- domain: pbs.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: portainer.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: pve.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: gitea-mcp.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: n8n-mcp.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: ha-mcp.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: pve-mcp.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: z2m25.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: iobroker.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: ccu.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: nautobot.bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: vw.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: hass.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: n8n.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: gitea.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: ds-bf.emsenhuber.net
|
|
answer: 10.40.20.40
|
|
enabled: true
|
|
- domain: nas.bf.emsenhuber.net
|
|
answer: 10.40.20.10
|
|
enabled: true
|
|
- domain: macmini.bf.emsenhuber.net
|
|
answer: 10.40.20.167
|
|
enabled: true
|
|
- domain: mfc.bf.emsenhuber.net
|
|
answer: 10.40.10.6
|
|
enabled: true
|
|
- domain: tv.bf.emsenhuber.net
|
|
answer: 10.40.40.11
|
|
enabled: true
|
|
- domain: docker.bf.emsenhuber.net
|
|
answer: 10.40.20.126
|
|
enabled: true
|
|
- domain: platform-pg.bf.emsenhuber.net
|
|
answer: 10.40.20.20
|
|
enabled: true
|
|
- domain: core.bf.emsenhuber.net
|
|
answer: 10.40.99.1
|
|
enabled: true
|
|
- domain: ap1.bf.emsenhuber.net
|
|
answer: 10.40.99.11
|
|
enabled: true
|
|
- domain: ap2.bf.emsenhuber.net
|
|
answer: 10.40.99.12
|
|
enabled: true
|
|
- domain: branch.bf.emsenhuber.net
|
|
answer: 10.40.99.2
|
|
enabled: true
|
|
safe_fs_patterns:
|
|
- /opt/AdGuardHome/userfilters/*
|
|
max_http_size: 256MB
|
|
safebrowsing_cache_size: 1048576
|
|
safesearch_cache_size: 1048576
|
|
parental_cache_size: 1048576
|
|
cache_time: 30
|
|
filters_update_interval: 24
|
|
blocked_response_ttl: 10
|
|
filtering_enabled: true
|
|
rewrites_enabled: true
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
protection_enabled: true
|
|
clients:
|
|
runtime_sources:
|
|
whois: true
|
|
arp: true
|
|
rdns: true
|
|
dhcp: true
|
|
hosts: true
|
|
persistent:
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: dns-bypass-exempt
|
|
ids:
|
|
- 10.40.10.82
|
|
- 10.40.10.183
|
|
tags: []
|
|
upstreams: []
|
|
uid: 381d431a-1a43-41ea-adaa-2d67ada9aab0
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: false
|
|
filtering_enabled: false
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: true
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-guest
|
|
ids:
|
|
- 10.40.90.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: af70dd86-43a9-4165-8228-26c7b90db5e6
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: false
|
|
filtering_enabled: true
|
|
parental_enabled: true
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-infra
|
|
ids:
|
|
- 10.40.20.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 78b2da82-1946-41ee-b386-b04eaee49bc3
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: false
|
|
filtering_enabled: false
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-iot
|
|
ids:
|
|
- 10.40.30.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 7a8ac674-4365-4b06-ad51-2516400903a1
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: true
|
|
filtering_enabled: true
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-main
|
|
ids:
|
|
- 10.40.10.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 39955cc1-6ec2-4cf6-a757-233672b9dc3d
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: true
|
|
filtering_enabled: true
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-media
|
|
ids:
|
|
- 10.40.40.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 44e4a1d7-d1b6-446c-a753-65e714ec93aa
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: false
|
|
filtering_enabled: false
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-mgmt
|
|
ids:
|
|
- 10.40.99.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 4c5eeafb-f7f2-4fb1-ab87-fd2a2366d57a
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: false
|
|
filtering_enabled: false
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
- safe_search:
|
|
enabled: false
|
|
bing: false
|
|
duckduckgo: false
|
|
ecosia: false
|
|
google: false
|
|
pixabay: false
|
|
yandex: false
|
|
youtube: false
|
|
blocked_services:
|
|
schedule:
|
|
time_zone: Local
|
|
ids: []
|
|
name: grp-untrusted
|
|
ids:
|
|
- 10.40.50.0/24
|
|
tags: []
|
|
upstreams: []
|
|
uid: 7f182498-7b82-4580-b1b0-0a2d46c205ef
|
|
upstreams_cache_size: 0
|
|
upstreams_cache_enabled: false
|
|
use_global_settings: true
|
|
filtering_enabled: true
|
|
parental_enabled: false
|
|
safebrowsing_enabled: false
|
|
use_global_blocked_services: true
|
|
ignore_querylog: false
|
|
ignore_statistics: false
|
|
log:
|
|
enabled: true
|
|
file: ""
|
|
max_backups: 0
|
|
max_size: 100
|
|
max_age: 3
|
|
compress: false
|
|
local_time: false
|
|
verbose: false
|
|
os:
|
|
group: ""
|
|
user: ""
|
|
rlimit_nofile: 0
|
|
schema_version: 34
|