feat(stack): add AdGuard Home DNS ad-blocking

Deploy AdGuard Home as network-wide DNS ad blocker with: - Quad9 DoH upstream for encrypted, security-focused DNS - Web UI on port 3053, DNS on 192.168.86.149:53 - Internal domain: dns.schweitz.internal Includes setup guide (ADGUARD_SETUP.md) for completing wizard. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-25 14:09:38 +01:00
parent 7f9e73a849
commit facdd6a2ec
3 changed files with 138 additions and 2 deletions
@@ -0,0 +1,56 @@
+version: '3.8'
+
+# AdGuard Home - Network-wide DNS Ad Blocking
+# Infrastructure Layer
+# Ports: 53 (DNS), 3053 (Web UI)
+# GPU: No
+# Storage: SSD (configs and work data)
+
+services:
+  adguard:
+    image: adguard/adguardhome:latest
+    container_name: adguard
+    restart: unless-stopped
+    ports:
+      - "192.168.86.149:53:53/tcp"   # DNS TCP (bound to LAN IP to avoid systemd-resolved conflict)
+      - "192.168.86.149:53:53/udp"   # DNS UDP
+      - "3053:3000/tcp"              # Web UI
+    volumes:
+      # SSD storage for configs and query logs
+      - /home/jpmschweitzer/docker-data/adguard/work:/opt/adguardhome/work
+      - /home/jpmschweitzer/docker-data/adguard/conf:/opt/adguardhome/conf
+    environment:
+      - TZ=Europe/Amsterdam
+    healthcheck:
+      test: ["CMD-SHELL", "nslookup localhost 127.0.0.1 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    networks:
+      - docker-dataplane
+
+networks:
+  docker-dataplane:
+    external: true
+    name: docker-dataplane
+
+# Setup Instructions:
+# 1. Deploy this stack via Portainer
+# 2. Access setup wizard at http://192.168.86.149:3053
+# 3. Configure:
+#    - Admin interface: Listen on port 3053, all interfaces
+#    - DNS server: Listen on port 53, all interfaces
+#    - Create admin username/password
+# 4. After setup, configure in AdGuard Home UI:
+#    - Settings → DNS settings → Upstream DNS:
+#      https://dns.quad9.net/dns-query
+#    - Enable "Parallel requests"
+#    - Filters → DNS blocklists → Add recommended lists
+# 5. Configure router DNS to 192.168.86.149
+#
+# Testing:
+# dig @192.168.86.149 google.com          # Should resolve
+# dig @192.168.86.149 ads.google.com      # Should be blocked
+#
+# Internal access: http://dns.schweitz.internal (requires NPM proxy + /etc/hosts entry)